CVE-2026-98951 riscv: ptrace: Zero-initialize regset buffers before copyin

Not scored Published 23 Oct 2026 Updated 23 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-98951?

CVE-2026-98951 is a vulnerability in Linux, published on 23 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

riscv: ptrace: Zero-initialize regset buffers before copyin

user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.

Which versions are affected by CVE-2026-98951?

How do I fix CVE-2026-98951?

Upgrade to a fixed version.

Is CVE-2026-98951 being exploited?

There is no known exploitation of CVE-2026-98951 in the wild and no public exploit code.

Sources

Also known as AZL-110759, BELL-CVE-2026-98951, DEBIAN-CVE-2026-98951, GHSA-3qfw-cx2f-h9pj, UBUNTU-CVE-2026-98951.