---
id: "CVE-2026-98951"
kind: "vulnerability"
aliases: ["CVE-2026-98951"]
title: "Linux kernel RISC-V ptrace: uninitialized stack data reaches task state"
severity: "unknown"
cvss: null
epss: 0.00198
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux-kernel", "riscv", "runtime"]
not_affected_if: ["non-riscv-hardware"]
published_at: "2026-10-23T13:17:16+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98951", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98951", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel RISC-V ptrace: uninitialized stack data reaches task state

A short PTRACE_SETREGSET request on RISC-V leaves part of a kernel stack buffer uninitialized, and that data is copied into the traced task's vector state or shadow stack pointer. The sources do not describe an attacker's concrete gain beyond this memory-safety flaw in the kernel.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the kernel version in the vendor advisory (unknown from sources)
- Check whether the host runs on RISC-V hardware (`uname -m` returns `riscv64`)
- unknown for a specific package or config check from the sources

## Fix

- Update the Linux kernel to a release that includes the upstream riscv ptrace fix (version unknown from sources)
- Reboot into the patched kernel after the distribution ships it

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98951
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98951

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

riscv: ptrace: Zero-initialize regset buffers before copyin

user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET
request with a short iov_len leaves the rest of the stack buffer
uninitialized. In riscv_vr_set() that garbage is validated and copied
into the target's vstate, and in riscv_cfi_set() it can be stored as
the target's shadow stack pointer. Zero both buffers, as the get path
already does.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_