Cloudanix VulnDB

CVE-2026-98951

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recent Linux fix on RISC-V hardware stops special debugging commands from accidentally feeding leftover memory values into important processor settings.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Uninitialized kernel stack buffers in RISC-V ptrace regset handling allow garbage values from short iov_len PTRACE_SETREGSET requests to be validated and copied into vector state or CFI shadow stack pointers.

Why it matters to the business

On RISC-V Linux systems, local attackers with ptrace access may trigger crashes or corrupt sensitive process state; the two-day-old disclosure and lack of known exploitation keep immediate operational risk low but warrant monitoring.

How an attack unfolds

An attacker with sufficient privileges issues a PTRACE_SETREGSET request whose iov_len is shorter than the expected regset size, leaving the remainder of the kernel buffer uninitialized; the riscv_vr_set and riscv_cfi_set paths then consume this garbage for vstate or shadow-stack storage.

How to fix it

Apply the upstream Linux kernel patch that zero-initializes the regset buffers in riscv_vr_set() and riscv_cfi_set() before the copyin call; rebuild and deploy the fixed kernel on all RISC-V systems.

How to confirm the fix worked

Confirm the presence of explicit zeroing of the vr and cfi regset buffers immediately before user_regset_copyin(); test by sending short-iov_len PTRACE_SETREGSET requests and verifying no uninitialized data propagates.

Typical attack path

  1. Obtain PTRACE_ATTACH or equivalent rights on a target process
  2. Issue PTRACE_SETREGSET with a deliberately short iov_len
  3. Trigger kernel validation and copy of the partially-initialized buffer
  4. Observe effects on vector registers or control-flow integrity state

How to detect it

Search kernel audit logs and ptrace traces for SETREGSET operations whose reported length is shorter than the expected regset size; correlate with any subsequent vector or stack-related oops or process anomalies.

What your security team should do

  • Prioritize kernel updates on all RISC-V production systems within standard change windows
  • Restrict ptrace via the Yama LSM or seccomp filters where debugging is not required
  • Add ptrace SETREGSET length anomalies to security monitoring rules

The record

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.

Affected packages

Ecosystem Package Introduced Fixed