Live › vulnerability › CVE-2026-98951
Go to dashboardA short PTRACE_SETREGSET request on RISC-V leaves part of a kernel stack buffer uninitialized, and that data is copied into the traced task's vector state or shadow stack pointer. The sources do not describe an attacker's concrete gain beyond this memory-safety flaw in the kernel.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel on RISC-V that allow ptrace-based register set updates, such as debuggers and tracing tools acting on other processes. Hosts on other architectures are not affected by this riscv-specific code path. The sources do not say whether unprivileged ptrace use is enough to trigger it.
No product ranges from the sources yet.
uname -r and compare against the kernel version in the vendor advisory (unknown from sources)uname -m returns riscv64)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
riscv: ptrace: Zero-initialize regset buffers before copyin
user_regset_copyin() only copies count bytes, so a PTRACE_SETREGSET
request with a short iov_len leaves the rest of the stack buffer
uninitialized. In riscv_vr_set() that garbage is validated and copied
into the target's vstate, and in riscv_cfi_set() it can be stored as
the target's shadow stack pointer. Zero both buffers, as the get path
already does.
This page as .md · .json · in your agent: get_signal("CVE-2026-98951")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.