CVE-2026-98951

In the Linux kernel, the following vulnerability has been resolved:

riscv: ptrace: Zero-initialize regset buffers before copyin

user regset copyin() only copies count bytes, so a PTRACE SETREGSET request with a short iov len leaves the rest of the stack buffer uninitialized. In riscv vr set() that garbage is validated and copied into the target's vstate, and in riscv cfi set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.