CVE-2026-74751

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> riscv: lib: Fix ZBB strnlen reading past count boundary<br /> <br /> The ZBB-optimized strnlen loop loads one word ahead before checking the<br /> aligned boundary:<br /> <br /> REG_L t1, SZREG(t0) // load next word<br /> addi t0, t0, SZREG // advance<br /> orc.b t1, t1<br /> bgeu t0, t4, 4f // boundary check AFTER load<br /> <br /> where t4 = (s + count) &amp; -SZREG. When s is aligned and count is a<br /> multiple of SZREG, t4 equals s + count and the loop loads a full word<br /> starting at exactly s + count. If s + count falls on a page boundary<br /> with the next page unmapped, this faults.<br /> <br /> Fix by computing the aligned boundary from the last valid byte<br /> (s + count - 1) instead of s + count. This makes the loop stop at the<br /> word containing the last valid byte rather than potentially loading the<br /> word after it. The count == 0 case is already handled by the beqz<br /> early exit.<br /> <br /> Also add a pre-loop guard (bgeu t0, t4) for the case where all valid<br /> bytes fit within the first word. With the adjusted boundary, t4 can<br /> equal t0, and entering the loop with stale register state from the<br /> first-word processing would produce incorrect results.<br /> <br /> The final minu clamp ensures the result is still correct when the last<br /> loaded word extends past s + count - 1 within the same aligned word.