CVE-2026-93266: arm64: RSI: fix field-spanning write warning in attestation token init

Published Sep 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

arm64: RSI: fix field-spanning write warning in attestation token init

The challenge is passed in registers a1 through a8. However, copying to &regs.a1 makes FORTIFY treat the destination as the single a1 field, resulting in a field-spanning write warning. [1]

Overlay the SMCCC register structure with an RSI-specific argument layout and copy the challenge into an explicit 64-byte array. This keeps the existing a1-a8 argument encoding while giving the copy a correctly sized destination object.

[1] memcpy: detected field-spanning write (size 64) of single field "&regs.a1" at ./arch/arm64/include/asm/rsicmds.h:119 (size 8) WARNING: ./arch/arm64/include/asm/rsicmds.h:119 at rsiattestationtokeninit+0xdc/0xf8 [armccaguest], CPU#0: cat/3314

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 24, 2026
CVE Published
via MITRE·03:52 PM
Data Sourced
via MITRE·03:52 PM
Description
Data Sourced
via NVD·04:17 PM
Description

Frequently Asked Questions

1

Which systems are implicated by the reported warning?

The warning is reported in the arm64 RSI attestation-token initialization path, with the trace identifying the arm_cca_guest component. The affected operation passes a 64-byte challenge through SMCCC registers a1 through a8.

2

How can I identify this condition in logs?

FORTIFY reports a field-spanning write of size 64 to the single field &regs.a1, whose field size is 8 bytes. The warning identifies rsi_attestation_token_init and arch/arm64/include/asm/rsi_cmds.h:119.

3

Does the correction change the register argument encoding?

No. The correction overlays the SMCCC register structure with an RSI-specific argument layout and copies the challenge into an explicit 64-byte array while retaining the existing a1-a8 encoding.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203