CVE-2026-98951
riscv: ptrace: Zero-initialize regset buffers before copyin
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
0.2%
Percentile 9.0%
as of 2026-10-24
CISA KEV
—
Not listed
Description
NVD
In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | affected: 9300f00439743c4a34d735e1a27118eb68a1504e … < 89fc70d73f4ac8781f9e15edd1dbc6b6088453b3 affected: 9300f00439743c4a34d735e1a27118eb68a1504e … < 59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97 affected: f2a9cd050901c4734bc175294c3bd6a40a1a9e99 affected: 6.5.3 … < 6.6 default: unaffected |
| Linux | Linux | affected: 6.6 unaffected: 0 … < 6.6 unaffected: 7.2.11 … <= 7.2.* unaffected: 7.3 … <= * default: affected |
Open-source packages (GitHub Advisory / OSV)
CVE-2026-98951
OSV
riscv: ptrace: Zero-initialize regset buffers before copyin
| Ecosystem | Package | Affected versions | Fixed in |
|---|---|---|---|
| >= 9300f00439743c4a34d735e1a27118eb68a1504e, < 89fc70d73f4ac8781f9e15edd1dbc6b6088453b3; < 59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97; >= 6.5.3, < 6.6; >= f2a9cd050901c4734bc175294c3bd6a40a1a9e99 v6.5.13, v6.5.12, v6.5.11, v6.5.10, v6.5.9, v6.5.8, v6.5.7, v6.5.6, v6.5.5, v6.5.4, v6.5.3 | 89fc70d73f4ac8781f9e15edd1dbc6b6088453b3, 59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97, 6.6 | ||
| Linux | Kernel | >= 6.6.0, < 7.2.11 | 7.2.11 |
Linux distribution status
References (5)
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git OSV
- https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97 NVD, CNA, OSV
- https://git.kernel.org/stable/c/89fc70d73f4ac8781f9e15edd1dbc6b6088453b3 NVD, CNA, OSV
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98951.json OSV
- https://nvd.nist.gov/vuln/detail/CVE-2026-98951 OSV