In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin()… (CVE-2026-98951)

The Linux kernel's riscv ptrace interface had a vulnerability where user_regset_copyin() only copied the specified count of bytes, leaving the remainder of the regset buffer uninitialized if the input vector length was short. This uninitialized data could then be validated and copied into critical kernel structures such as the target's vstate or shadow stack pointer in riscv_vr_set() and riscv_cfi_set(). The vulnerability was fixed by zero-initializing both buffers before copying, aligning with the behavior of the get path.

Uninitialized kernel memory could be introduced into critical kernel data structures related to the riscv ptrace interface, potentially leading to undefined behavior or security issues such as information leakage or corruption of control flow data. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to zero-initialize regset buffers before copying user data in the riscv ptrace code. Users should update to the patched kernel version once available. No additional mitigation steps are indicated.