PT-2026-61399 · Linux · Linux

CVE-2026-64082 · Published 2026-07-19 · Updated 2026-07-19

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

riscv: Fix register corruption from uninitialized cregs on error

compat riscv gpr set() calls cregs to regs() unconditionally, even when user regset copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt regs, corrupting its register state and potentially leaking kernel stack contents.

compat restore sigcontext() has the same issue: it calls cregs to regs() even when copy from user() fails, leading to the same corruption of the signal-returning task's register state on error.

Only call cregs to regs() when the user copy succeeds.

Fix

Related Identifiers

CVE-2026-64082

Affected Products

Linux

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-64082 · Security Note
• https://git.kernel.org/stable/c/9e020156833f1ad0d425a1e3d85b65639f1c1c50 · Note
• https://git.kernel.org/stable/c/6ebcbb53fc9bc30843054ed99fd60b8e542628f4 · Note