CVE-2026-74751 Overview
CVE-2026-74751 is an out-of-bounds read vulnerability in the Linux kernel's RISC-V architecture support code. The flaw resides in the ZBB-optimized strnlen implementation within riscv/lib. The optimized loop loads one word ahead of the aligned boundary check, which can cause a read past the caller-supplied count boundary. When the source string sits at a page boundary and the following page is unmapped, the extra word load triggers a fault. The issue affects kernel builds that enable the Zbb bit-manipulation extension routines on RISC-V hardware.
Critical Impact
The strnlen routine can read one word past the intended count boundary, faulting on unmapped pages and enabling denial of service or information exposure in kernel contexts.
Affected Products
- Linux kernel RISC-V architecture (arch/riscv/lib)
- Kernel builds compiled with ZBB (Zbb) bit-manipulation extension support
- Downstream distributions shipping affected RISC-V kernel versions
Discovery Timeline
- 2026-08-26 - CVE-2026-74751 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-74751
Vulnerability Analysis
The ZBB-optimized strnlen implementation in arch/riscv/lib uses a word-at-a-time scanning loop to accelerate string length calculation. The loop loads the next machine word using REG_L t1, SZREG(t0), advances the pointer, computes orc.b, and then performs the boundary check with bgeu t0, t4, 4f. The boundary register t4 is computed as (s + count) & -SZREG.
When s is aligned and count is a multiple of SZREG, t4 equals s + count. The loop then loads a full word beginning at exactly s + count, which lies outside the caller-authorized range. If that address sits on a page boundary with the following page unmapped, the kernel takes a fault. This constitutes an out-of-bounds read [CWE-125] in kernel memory.
Root Cause
The defect stems from computing the aligned end boundary from s + count rather than from the last valid byte s + count - 1. Combined with the pre-load pattern in the ZBB loop, this permits the routine to dereference the word immediately following the authorized buffer. The absence of a pre-loop guard also allows the loop body to execute with stale register state when all valid bytes fit inside the first word.
Attack Vector
An attacker who can influence strnlen inputs from kernel paths that accept user-controlled string buffers may position a string precisely at a page boundary. Triggering strnlen on such a buffer forces the extra word read into an unmapped page, faulting the kernel. Depending on the calling context, the fault can produce a kernel oops, a denial of service, or unintended reads of adjacent kernel data.
The vulnerability manifests only on RISC-V hardware with ZBB support enabled. See the Kernel Git Commit 5d588c6 and Kernel Git Commit e697e30 for the exact assembly change.
Detection Methods for CVE-2026-74751
Indicators of Compromise
- Unexpected kernel oops or page fault messages referencing strnlen on RISC-V hosts
- Kernel log entries showing Unable to handle kernel paging request originating from arch/riscv/lib/strnlen
- Sudden process termination when handling strings positioned near page boundaries
Detection Strategies
- Inventory RISC-V systems and identify kernel builds compiled with ZBB extension support
- Compare running kernel versions against the fixed commits 5d588c6 and e697e30 in the stable tree
- Review crash dumps and dmesg output for faults whose call stacks include strnlen in the RISC-V library path
Monitoring Recommendations
- Forward kernel logs from RISC-V endpoints to a central analytics pipeline and alert on repeated strnlen faults
- Track kernel package versions across the RISC-V fleet and flag hosts still running vulnerable builds
- Monitor for abnormal syscall failure patterns on RISC-V nodes that could indicate probing of the boundary condition
How to Mitigate CVE-2026-74751
Immediate Actions Required
- Apply the upstream fix from commits 5d588c684833e678a0008eb69c33190f01a65f4b and e697e30f3dd2da3a1df7dc0980546d5b53aea4b6
- Update RISC-V kernel packages to a stable release that includes the corrected strnlen boundary computation
- Reboot affected systems after patch installation to load the fixed kernel image
Patch Information
The upstream fix computes the aligned boundary from s + count - 1 instead of s + count, ensuring the loop terminates on the word containing the last valid byte. The patch also introduces a pre-loop guard bgeu t0, t4 to prevent execution with stale first-word state, while the existing minu clamp preserves correctness when the loaded word extends past the last valid byte within the same aligned word. Distribution-specific kernel updates should be tracked through the vendor's security advisory channel.
Workarounds
- Rebuild the kernel without ZBB-optimized string routines if immediate patching is not feasible
- Restrict RISC-V workloads to trusted inputs until the patched kernel is deployed
- Isolate RISC-V hosts running vulnerable kernels from untrusted network sources that can supply crafted string inputs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
