CVE-2026-98951 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Linux Kernel

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97
https://git.kernel.org/stable/c/89fc70d73f4ac8781f9e15edd1dbc6b6088453b3

History

Fri, 23 Oct 2026 17:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-254

Fri, 23 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.
Title		riscv: ptrace: Zero-initialize regset buffers before copyin
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97 https://git.kernel.org/stable/c/89fc70d73f4ac8781f9e15edd1dbc6b6088453b3

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:19:10.747Z

Updated: 2026-10-23T12:19:10.747Z

Reserved: 2026-09-25T10:25:14.382Z

Link: CVE-2026-98951

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:16.267

Modified: 2026-10-23T13:17:16.267

Link: CVE-2026-98951

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98951", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.382Z", "datePublished": "2026-10-23T12:19:10.747Z", "dateUpdated": "2026-10-23T12:19:10.747Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:19:10.747Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: ptrace: Zero-initialize regset buffers before copyin\n\nuser_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET\nrequest with a short iov_len leaves the rest of the stack buffer\nuninitialized. In riscv_vr_set() that garbage is validated and copied\ninto the target's vstate, and in riscv_cfi_set() it can be stored as\nthe target's shadow stack pointer. Zero both buffers, as the get path\nalready does."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/riscv/kernel/ptrace.c"], "versions": [{"version": "9300f00439743c4a34d735e1a27118eb68a1504e", "lessThan": "89fc70d73f4ac8781f9e15edd1dbc6b6088453b3", "status": "affected", "versionType": "git"}, {"version": "9300f00439743c4a34d735e1a27118eb68a1504e", "lessThan": "59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97", "status": "affected", "versionType": "git"}, {"version": "f2a9cd050901c4734bc175294c3bd6a40a1a9e99", "status": "affected", "versionType": "git"}, {"version": "6.5.3", "lessThan": "6.6", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/riscv/kernel/ptrace.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/89fc70d73f4ac8781f9e15edd1dbc6b6088453b3"}, {"url": "https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97"}], "title": "riscv: ptrace: Zero-initialize regset buffers before copyin", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/riscv/kernel/ptrace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "89fc70d73f4ac8781f9e15edd1dbc6b6088453b3", "status": "affected", "version": "9300f00439743c4a34d735e1a27118eb68a1504e", "versionType": "git"}, {"lessThan": "59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97", "status": "affected", "version": "9300f00439743c4a34d735e1a27118eb68a1504e", "versionType": "git"}, {"status": "affected", "version": "f2a9cd050901c4734bc175294c3bd6a40a1a9e99", "versionType": "git"}, {"lessThan": "6.6", "status": "affected", "version": "6.5.3", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/riscv/kernel/ptrace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: ptrace: Zero-initialize regset buffers before copyin\n\nuser_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET\nrequest with a short iov_len leaves the rest of the stack buffer\nuninitialized. In riscv_vr_set() that garbage is validated and copied\ninto the target's vstate, and in riscv_cfi_set() it can be stored as\nthe target's shadow stack pointer. Zero both buffers, as the get path\nalready does."}], "id": "CVE-2026-98951", "lastModified": "2026-10-23T13:17:16.267", "metrics": {}, "published": "2026-10-23T13:17:16.267", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/89fc70d73f4ac8781f9e15edd1dbc6b6088453b3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}