SB20261023215 - Use of Uninitialized Variable in Linux kernel riscv kernel

Description

This security bulletin contains information about 1 vulnerability.

1) Use of Uninitialized Variable (CVE-ID: CVE-2026-98951)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt a target process's vector register state or shadow stack pointer with uninitialized kernel stack data.

The vulnerability exists due to use of uninitialized stack memory in the Linux kernel's riscv_vr_set() and riscv_cfi_set() functions when processing PTRACE_SETREGSET requests with a short iov_len. A local user can submit a request that supplies only part of a register-set buffer to cause the remaining uninitialized bytes to be used in the target process's vector state or shadow stack pointer.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97
• https://git.kernel.org/stable/c/89fc70d73f4ac8781f9e15edd1dbc6b6088453b3