CVE-2026-98951: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.

Засегнати продукти

• Linux Linux: 9300f00439743c4a34d735e1a27118eb68a1504e преди 89fc70d73f4ac8781f9e15edd1dbc6b6088453b3; 9300f00439743c4a34d735e1a27118eb68a1504e преди 59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97; f2a9cd050901c4734bc175294c3bd6a40a1a9e99; 6.5.3 преди 6.6
• Linux Linux: 6.6; преди 6.6; 7.2.11 до 7.2.*; от 7.3 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99265
• CVE-2026-99261
• CVE-2026-99260

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-98951
• https://nvd.nist.gov/vuln/detail/CVE-2026-98951
• https://git.kernel.org/stable/c/89fc70d73f4ac8781f9e15edd1dbc6b6088453b3
• https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97