CVE-2026-64082 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
riscv: Fix register corruption from uninitialized cregs on error
compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt_regs, corrupting its register state and potentially leaking kernel stack contents.
compat_restore_sigcontext() has the same issue: it calls cregs_to_regs() even when __copy_from_user() fails, leading to the same corruption of the signal-returning task's register state on error.
Only call cregs_to_regs() when the user copy succeeds.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists in the riscv architecture implementation within the Linux kernel where improper handling of register state during error conditions leads to critical security flaws. The issue manifests in two primary functions: compat_riscv_gpr_set() and compat_restore_sigcontext() which both exhibit identical problematic behavior patterns. Both functions invoke cregs_to_regs() regardless of whether preceding user space copy operations succeed or fail, creating a scenario where uninitialized stack variables containing kernel memory contents are written into target task register states.
The technical flaw stems from direct manipulation of processor register state without proper error handling validation. When user_regset_copyin() or __copy_from_user() operations fail, these functions continue execution and pass uninitialized cregs data structures to cregs_to_regs() which then populates the target pt_regs structure with whatever garbage data exists in the uninitialized stack memory. This creates a deterministic information disclosure vulnerability where kernel stack contents become accessible to user space processes through corrupted register state.
The operational impact of this vulnerability extends beyond simple information leakage to potentially enable privilege escalation and code execution attacks. Attackers can exploit the register corruption to manipulate program flow, bypass security controls, or extract sensitive kernel memory information. This aligns with CWE-248 Uncaught Exception and CWE-125 Out-of-bounds Read patterns, where improper error handling leads to exploitable conditions. The vulnerability particularly affects systems running riscv architecture kernels where compatibility mode operations are utilized for legacy application support.
The attack surface is significant given that this affects both general register state management and signal context restoration mechanisms. Modern exploitation techniques can leverage such register corruption to construct sophisticated attacks leveraging the ATT&CK framework's privilege escalation tactics, specifically targeting process control and memory manipulation capabilities. The vulnerability demonstrates poor defensive programming practices where error conditions are not properly validated before proceeding with critical operations that modify system state.
Mitigation strategies must focus on implementing proper error handling validation before executing register state modification operations. The fix requires modifying both functions to only invoke cregs_to_regs() when user space copy operations complete successfully. This approach aligns with secure coding practices emphasizing defensive programming and proper resource management. System administrators should prioritize kernel updates containing this fix, while developers should implement similar validation patterns in other architecture-specific implementations to prevent analogous issues from arising in future code modifications.