{"id":"CVE-2026-98951","kind":"vulnerability","aliases":["CVE-2026-98951"],"related":[],"title":"Linux kernel RISC-V ptrace: uninitialized stack data reaches task state","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: ptrace: Zero-initialize regset buffers before copyin\n\nuser_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET\nrequest with a short iov_len leaves the rest of the stack buffer\nuninitialized. In riscv_vr_set() that garbage is validated and copied\ninto the target's vstate, and in riscv_cfi_set() it can be stored as\nthe target's shadow stack pointer. Zero both buffers, as the get path\nalready does.","summary":"A short PTRACE_SETREGSET request on RISC-V leaves part of a kernel stack buffer uninitialized, and that data is copied into the traced task's vector state or shadow stack pointer. The sources do not describe an attacker's concrete gain beyond this memory-safety flaw in the kernel.","severity":"unknown","cvss":null,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","riscv","runtime"],"not_affected_if":["non-riscv-hardware"],"how_to_check":"- `uname -r` and compare against the kernel version in the vendor advisory (unknown from sources)\n- Check whether the host runs on RISC-V hardware (`uname -m` returns `riscv64`)\n- unknown for a specific package or config check from the sources","fix":"- Update the Linux kernel to a release that includes the upstream riscv ptrace fix (version unknown from sources)\n- Reboot into the patched kernel after the distribution ships it","status":"open","published_at":"2026-10-23T13:17:16+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:54+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:57:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream riscv ptrace fix (version unknown from sources)\n- Reboot into the patched kernel after the distribution ships it","reach":"local","title":"Linux kernel RISC-V ptrace: uninitialized stack data reaches task state","impact":"medium","summary":"A short PTRACE_SETREGSET request on RISC-V leaves part of a kernel stack buffer uninitialized, and that data is copied into the traced task's vector state or shadow stack pointer. The sources do not describe an attacker's concrete gain beyond this memory-safety flaw in the kernel.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","riscv"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; kernel memory contents may leak into traced task state","analyst_note":"Confirm the affected and fixed kernel versions and whether ptrace access needs privileges, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98951.","how_to_check":"- `uname -r` and compare against the kernel version in the vendor advisory (unknown from sources)\n- Check whether the host runs on RISC-V hardware (`uname -m` returns `riscv64`)\n- unknown for a specific package or config check from the sources","needs_analyst":true,"not_affected_if":["non-riscv-hardware"],"who_is_affected":"Systems running a Linux kernel on RISC-V that allow ptrace-based register set updates, such as debuggers and tracing tools acting on other processes. Hosts on other architectures are not affected by this riscv-specific code path. The sources do not say whether unprivileged ptrace use is enough to trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":3403,"output_tokens":648,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98951':15A,18A 'alreadi':158C 'attack':63B 'beyond':67B 'buffer':39B,92C,118C,153C 'byte':101C 'cfi':138C 'concret':65B 'copi':45B,99C,129C 'copyin':94C,97C 'count':100C 'cve':13A,16A 'data':9A,43B 'describ':61B 'flaw':72B 'follow':81C 'gain':66B 'garbag':125C 'get':156C 'initi':90C 'iov':110C 'kernel':2A,21B,37B,75B,79C 'leav':33B,112C 'len':111C 'linux':1A,20B,78C 'linux-kernel':19B 'memori':70B 'memory-safeti':69B 'part':34B 'path':157C 'pointer':56B,150C 'ptrace':6A,26B,87C,104C 'reach':10A 'regset':91C,96C 'request':28B,106C 'resolv':85C 'rest':114C 'risc':4A,31B 'risc-v':3A,30B 'riscv':22B,86C,121C,137C 'runtim':23B 'safeti':71B 'set':123C,139C 'setregset':27B,105C 'shadow':54B,148C 'short':25B,109C 'sourc':58B 'stack':8A,38B,55B,117C,149C 'state':12A,52B 'store':143C 'target':132C,146C 'task':11A,49B 'trace':48B 'uniniti':7A,40B,119C 'user':95C 'v':5A,32B 'valid':127C 'vector':51B 'vr':122C 'vstate':134C 'vulner':82C 'zero':89C,151C 'zero-initi':88C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel on RISC-V that allow ptrace-based register set updates, such as debuggers and tracing tools acting on other processes. Hosts on other architectures are not affected by this riscv-specific code path. The sources do not say whether unprivileged ptrace use is enough to trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98951","severity":null,"published_at":"2026-10-23T13:17:16+00:00","modified_at":"2026-10-23T13:17:16+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98951","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98951","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}