Cloudanix VulnDB

CVE-2026-93167

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A tracing bug on certain processors can make programs being debugged receive wrong information when they ask the operating system to map memory, causing them to fail.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The syscall trace path on C-SKY ABIv2 reloads the 5th and 6th arguments (a4/a5) from pt_regs after adjusting the stack pointer, causing those loads to fetch incorrect stack slots and pass corrupted values to the syscall handler.

Why it matters to the business

Traced or debugged applications on affected C-SKY systems that use six-argument syscalls such as mmap2 may receive wrong parameters, leading to mapping failures, unexpected exits, or incorrect memory operations during development, monitoring, or security tooling.

How an attack unfolds

An attacker with local access attaches a tracer via PTRACE_SYSCALL to a target process, forces a six-argument syscall such as mmap, and observes the process receive corrupted arguments that cause the syscall to fail or produce unintended memory mappings.

How to fix it

Apply the upstream fix that loads LSAVE_A4 and LSAVE_A5 from pt_regs before adjusting the stack pointer; rebuild and deploy the corrected Linux kernel for C-SKY ABIv2.

How to confirm the fix worked

Reproduce the mmap2 test case under PTRACE_SYSCALL before and after the patch; confirm the child process exits with status 0 instead of 12 after applying the fix.

Typical attack path

  1. Obtain local execution or attach privileges on a C-SKY ABIv2 system
  2. Attach a ptrace-based tracer to the target process
  3. Trigger a six-argument syscall such as mmap2 inside the traced child
  4. Observe corrupted argument values leading to syscall failure or memory corruption

How to detect it

Search process logs and audit trails for traced processes that invoke mmap-family syscalls and exit with status 12; correlate with ptrace attachment events on C-SKY systems.

What your security team should do

  • Identify all C-SKY ABIv2 kernels in the environment and schedule immediate patching
  • Test the provided mmap2 reproducer in lab systems to validate the fix
  • Review any custom tracing or debugging tools that rely on syscall argument fidelity

The record

In the Linux kernel, the following vulnerability has been resolved: csky: Fix a4/a5 restoration in syscall trace path The syscall trace path reloads syscall arguments from pt_regs before calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall arguments are prepared as stack arguments before invoking syscallid. The current code adjusts sp before loading LSAVE_A4 and LSAVE_A5. Since those offsets are relative to the original pt_regs base, loading them after changing sp fetches the wrong slots. As a result, traced syscalls that use the 5th or 6th argument may receive corrupted arguments. This is visible with mmap2(), which takes six arguments. A small PTRACE_SYSCALL reproducer opens a file and maps one page with: mmap(NULL, 4096, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0) Before the fix, the traced child fails the mmap and exits with 12. After the fix, the mapping succeeds and the child exits with 0. Fix the trace path by loading a4/a5 from pt_regs before changing sp. Tested on: ck860f, linux-4.19.15, C-SKY abiv2

Affected packages

Ecosystem Package Introduced Fixed