PT-2026-121923
CVE-2026-98951
·
Published
2026-10-23
·
Updated
2026-10-23
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
riscv: ptrace: Zero-initialize regset buffers before copyin
user regset copyin() only copies
count bytes, so a PTRACE SETREGSET
request with a short iov len leaves the rest of the stack buffer
uninitialized. In riscv vr set() that garbage is validated and copied
into the target's vstate, and in riscv cfi set() it can be stored as
the target's shadow stack pointer. Zero both buffers, as the get path
already does. Found an issue in the description? Have something to add? Feel free to write us 👾