PT-2026-61399 · Linux · Linux

CVE-2026-64082 · Publicado 2026-07-19 · Atualizado 2026-07-19

Mitre

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

riscv: Fix register corruption from uninitialized cregs on error

compat riscv gpr set() calls cregs to regs() unconditionally, even when user regset copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt regs, corrupting its register state and potentially leaking kernel stack contents.

compat restore sigcontext() has the same issue: it calls cregs to regs() even when copy from user() fails, leading to the same corruption of the signal-returning task's register state on error.

Only call cregs to regs() when the user copy succeeds.

Correção

Identificadores relacionados

CVE-2026-64082

Produtos afetados

Linux

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-64082 · Nota de Segurança
• https://git.kernel.org/stable/c/9e020156833f1ad0d425a1e3d85b65639f1c1c50 · Nota
• https://git.kernel.org/stable/c/6ebcbb53fc9bc30843054ed99fd60b8e542628f4 · Nota