CVE-2026-64082
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
19/07/2026
Última modificación:
20/07/2026
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
riscv: Fix register corruption from uninitialized cregs on error<br />
<br />
compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when<br />
user_regset_copyin() fails. Since cregs is an uninitialized stack<br />
variable, a copyin failure causes uninitialized stack data to be written<br />
into the target task&#39;s pt_regs, corrupting its register state and<br />
potentially leaking kernel stack contents.<br />
<br />
compat_restore_sigcontext() has the same issue: it calls cregs_to_regs()<br />
even when __copy_from_user() fails, leading to the same corruption of<br />
the signal-returning task&#39;s register state on error.<br />
<br />
Only call cregs_to_regs() when the user copy succeeds.
Impacto
Puntuación base 3.x
7.80
Gravedad 3.x
ALTA