Junglewise Threat Intelligence

CVE-2026-74751: Linux kernel RISC-V lib strnlen buffer over-read

CVE-2026-74751 · Severity: critical · CVSS 9.4 · Published 2026-08-26

Executive brief

The Linux kernel's RISC-V strnlen() string function contains a buffer over-read vulnerability in its ZBB-optimized assembly implementation. The function can read memory beyond the specified byte count when the count boundary aligns with a page boundary, causing kernel crashes or potential information disclosure. This affects RISC-V systems running vulnerable kernel versions.

Technical details

The vulnerability exists in the ZBB-optimized strnlen implementation in arch/riscv/lib/strnlen.S, where a pre-loop word load occurs before the aligned boundary check is performed. When the count parameter is a multiple of SZREG (register size) and aligns with a page boundary, the function loads a full word starting exactly at s+count, which can fault if the next page is unmapped. The root cause is computing the aligned boundary from s+count instead of s+count-1. The fix adjusts boundary calculation to use the last valid byte address and adds a pre-loop guard condition to prevent entering the loop when all bytes fit in the first word. This is a local issue affecting any code path calling strnlen() with boundary-aligned counts on RISC-V systems.

Affected products

  • Linux Linux Kernel 5.x through 7.x (RISC-V architecture with ZBB optimization enabled)

Timeline

  • 2026-08-26: disclosed
  • 2026-04-13: patched: Upstream patch committed by Michael Neuling
  • 2026-08-08: patched: Merged into mainline by Paul Walmsley

References

Related threats