In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen reading past count boundary The ZBB-optimized… (CVE-2026-74751)

The vulnerability in the Linux kernel affects the RISC-V architecture's optimized strnlen function using Zero Branch Bound (ZBB) optimization. The function's loop loads one word beyond the count boundary before checking if it has reached the aligned boundary, which can cause a fault if the next memory page is unmapped. The root cause is that the aligned boundary was computed from s + count instead of s + count - 1, leading to an out-of-bounds load. The fix changes the boundary calculation to use the last valid byte and adds a pre-loop guard to handle cases where all valid bytes fit within the first word, ensuring no stale register state causes incorrect results. This prevents the function from reading past the intended memory region.

This vulnerability can cause the Linux kernel on RISC-V systems to read memory beyond the intended buffer boundary, potentially triggering a page fault if the next page is unmapped. The CVSS score of 9.4 indicates a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and availability, with limited integrity impact. This could lead to denial of service or information disclosure on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or vendor advisory link is provided, users should monitor official Linux kernel updates for a fix addressing CVE-2026-74751. Until then, avoid running untrusted code that could trigger this vulnerability on RISC-V Linux systems.