CVE-2026-64082 Overview
CVE-2026-64082 is a Linux kernel vulnerability affecting the RISC-V architecture's compat (32-bit compatibility) layer. The flaw resides in compat_riscv_gpr_set() and compat_restore_sigcontext(), both of which invoke cregs_to_regs() unconditionally without checking whether the preceding user-space copy operation succeeded. When user_regset_copyin() or __copy_from_user() fails, uninitialized stack data is written into the target task's pt_regs, corrupting register state and potentially leaking kernel stack contents to userspace.
Critical Impact
A local, low-privileged attacker can corrupt a task's register state and leak kernel stack memory, enabling information disclosure and potential privilege escalation on RISC-V systems running 32-bit compat binaries.
Affected Products
- Linux kernel on RISC-V architecture with CONFIG_COMPAT enabled
- Kernel versions prior to commits 6ebcbb53fc9b and 9e020156833f
- Distributions shipping affected RISC-V kernels for 32-bit compat workloads
Discovery Timeline
- 2026-07-19 - CVE-2026-64082 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64082
Vulnerability Analysis
The defect exists in two RISC-V compat-mode functions that translate 32-bit register representations into the kernel's native pt_regs layout. Both compat_riscv_gpr_set() and compat_restore_sigcontext() declare a local cregs structure on the kernel stack and populate it via a copy-from-user routine. The functions then call cregs_to_regs() to translate cregs into the task's pt_regs, regardless of whether the user copy succeeded.
When the copy fails, cregs retains whatever data previously occupied that stack slot. The translation routine then writes this stale, uninitialized memory into pt_regs, corrupting the general-purpose register state of the target task. Because pt_regs is restored on return to userspace, the corrupted values become directly observable by the process, leaking kernel stack contents across the trust boundary.
Root Cause
The root cause is missing error handling around user-copy operations, an instance of uninitialized memory use combined with a missing input validation check. The code assumes success and applies side effects unconditionally, violating the standard kernel pattern of returning early on copy_from_user failure.
Attack Vector
Exploitation requires local access with the ability to execute a 32-bit compat process or invoke ptrace() against one. An attacker triggers the failing copy path by passing an unmapped or unreadable user buffer to PTRACE_SETREGSET or by constructing a malformed signal frame that fails validation in compat_restore_sigcontext(). The failed copy leaves cregs uninitialized, and the subsequent unconditional call to cregs_to_regs() writes stack residue into pt_regs. The corrupted register file is then delivered to the target task on the next return-to-userspace, exposing kernel stack contents. The vulnerability requires local, low-privileged access and no user interaction.
Detection Methods for CVE-2026-64082
Indicators of Compromise
- Unexpected SIGSEGV, SIGBUS, or SIGILL in 32-bit compat processes on RISC-V hosts following ptrace() or signal-return operations
- Anomalous register values observed in compat tasks that do not match prior program state
- Repeated PTRACE_SETREGSET calls with deliberately invalid user buffers from unprivileged processes
Detection Strategies
- Audit kernel version and RISC-V configuration to identify hosts running vulnerable compat code paths
- Enable kernel address sanitizer (KASAN) and stack initialization (CONFIG_INIT_STACK_ALL_ZERO) in test environments to surface uninitialized reads
- Monitor ptrace() syscall telemetry for unprivileged callers targeting compat tasks with abnormal error rates
Monitoring Recommendations
- Collect and centralize auditd records for ptrace and rt_sigreturn syscalls on RISC-V systems
- Track kernel dmesg output for anomalies during compat signal delivery and register-set operations
- Alert on processes generating high volumes of failed PTRACE_SETREGSET operations against child tasks
How to Mitigate CVE-2026-64082
Immediate Actions Required
- Apply the upstream fix by rebuilding or updating to a kernel containing commits 6ebcbb53fc9bc30843054ed99fd60b8e542628f4 and 9e020156833f1ad0d425a1e3d85b65639f1c1c50
- Inventory RISC-V hosts and identify any workloads that rely on 32-bit compat binaries
- Restrict ptrace() access using kernel.yama.ptrace_scope=2 or higher where operationally feasible
Patch Information
The fix ensures cregs_to_regs() is invoked only when the user copy succeeds. The relevant upstream changes are available in the Linux kernel commit 6ebcbb53fc9b and Linux kernel commit 9e020156833f. Distribution maintainers should backport both patches to supported stable branches.
Workarounds
- Disable CONFIG_COMPAT on RISC-V builds where 32-bit userspace is not required
- Tighten ptrace_scope via sysctl kernel.yama.ptrace_scope=2 to limit unprivileged tracing
- Enable CONFIG_INIT_STACK_ALL_ZERO to zero stack allocations and neutralize residual-data leakage
# Restrict ptrace and verify running kernel version
sudo sysctl -w kernel.yama.ptrace_scope=2
echo 'kernel.yama.ptrace_scope=2' | sudo tee /etc/sysctl.d/10-ptrace.conf
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
