Executive brief
The Linux kernel's RISC-V strnlen() string function contains a buffer over-read vulnerability in its ZBB-optimized assembly implementation. The function can read memory beyond the specified byte count when the count boundary aligns with a page boundary, causing kernel crashes or potential information disclosure. This affects RISC-V systems running vulnerable kernel versions.
Technical details
The vulnerability exists in the ZBB-optimized strnlen implementation in arch/riscv/lib/strnlen.S, where a pre-loop word load occurs before the aligned boundary check is performed. When the count parameter is a multiple of SZREG (register size) and aligns with a page boundary, the function loads a full word starting exactly at s+count, which can fault if the next page is unmapped. The root cause is computing the aligned boundary from s+count instead of s+count-1. The fix adjusts boundary calculation to use the last valid byte address and adds a pre-loop guard condition to prevent entering the loop when all bytes fit in the first word. This is a local issue affecting any code path calling strnlen() with boundary-aligned counts on RISC-V systems.
Affected products
- Linux Linux Kernel 5.x through 7.x (RISC-V architecture with ZBB optimization enabled)
Timeline
- 2026-08-26: disclosed
- 2026-04-13: patched: Upstream patch committed by Michael Neuling
- 2026-08-08: patched: Merged into mainline by Paul Walmsley