CVE-2026-98951: riscv: ptrace: Zero-initialize regset buffers before copyin
Published Oct 23, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
riscv: ptrace: Zero-initialize regset buffers before copyin
userregsetcopyin() only copies count bytes, so a PTRACESETREGSET request with a short iovlen leaves the rest of the stack buffer uninitialized. In riscvvrset() that garbage is validated and copied into the target's vstate, and in riscvcfiset() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.
Affected Software
1 affected component
Linux Linux kernel
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Zero-initialize both regset buffers before calling user_regset_copyin() in riscv_vr_set() and riscv_cfi_set(), ensuring bytes beyond a short iov_len are not left uninitialized.
Event History
Oct 23, 2026
CVE Published
via MITRE·12:19 PM
Data Sourced
via MITRE·12:19 PM
Description