CVE-2026-98951

Name	CVE-2026-98951
Description	In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	bookworm	6.1.176-1	fixed
	bookworm (security)	6.1.190-1	fixed
	trixie	6.12.107-1	vulnerable
	trixie (security)	6.12.116-1	vulnerable
	forky	7.2.15-1	fixed
	sid	7.3.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
linux	source	bookworm	(not affected)
linux	source	(unstable)	7.2.11-1

[bookworm] - linux <not-affected> (Vulnerable code not present)
https://git.kernel.org/linus/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97 (7.3-rc7)