Executive brief
A vulnerability in the Linux kernel for RISC-V processors could allow a local attacker to corrupt system memory or view sensitive information. The issue occurs when the system fails to properly handle errors during certain internal operations, leading to the use of uninitialized data. This could result in system instability or the leakage of private kernel data to unauthorized users.
Technical details
A vulnerability exists in the RISC-V architecture implementation of the Linux kernel within the compat_riscv_gpr_set() and compat_restore_sigcontext() functions. These functions were calling cregs_to_regs() unconditionally, even if preceding copy operations from user space (user_regset_copyin or __copy_from_user) failed. Because the 'cregs' variable is an uninitialized stack variable, a failure in the copy operation results in uninitialized stack data being written into the target task's pt_regs. This leads to register state corruption and potential information disclosure of kernel stack memory. The issue has been patched by ensuring cregs_to_regs() is only called upon a successful user copy.
Affected products
- Linux Linux Kernel 5.19 to 7.1
Timeline
- 2026-05-01: other: Patch submitted by Michael Neuling
- 2026-07-19: disclosed: CVE published in NVD dataset