{"id":"CVE-2026-98951","published":"2026-10-23T13:17:16.267","lastModified":"2026-10-23T13:17:16.267","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: ptrace: Zero-initialize regset buffers before copyin\n\nuser_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET\nrequest with a short iov_len leaves the rest of the stack buffer\nuninitialized. In riscv_vr_set() that garbage is validated and copied\ninto the target's vstate, and in riscv_cfi_set() it can be stored as\nthe target's shadow stack pointer. Zero both buffers, as the get path\nalready does.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97","tags":[]},{"url":"https://git.kernel.org/stable/c/89fc70d73f4ac8781f9e15edd1dbc6b6088453b3","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}