EUVD-2026-39194
GHSA-qhcg-6255-c538
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local access and low privilege required; C:L added to reflect syzbot's confirmed kernel-infoleak finding, diverging from NVD's C:N.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()
There is an bug in which an uninitialized stack variable is used in rseq_exit_user_update() as reported by syzbot:
BUG: KMSAN: kernel-infoleak in rseq_set_ids_get_csaddr include/linux/rseq_entry.h:502 [inline]
The local variable:
struct rseq_ids ids = { .cpu_id = task_cpu(t), .mm_cid = task_mm_cid(t), .node_id = cpu_to_node(ids.cpu_id), };
According to the C standard, the evaluation order of expressions in an initializer list is indeterminately sequenced. The compiler (Clang, in this KMSAN build) evaluates cpu_to_node(ids.cpu_id) *before* ids.cpu_id is initialized with task_cpu(t).
This is fixed by moving the assignment of ids.node_id outside the structure initialization.
AnalysisAI
Uninitialized stack variable use in the Linux kernel's rseq (restartable sequences) subsystem exposes systems to kernel information leak and denial-of-service. The flaw in rseq_exit_user_update() arises from a C standard evaluation-order ambiguity in struct initialization, detected by syzbot's KMSAN (Kernel Memory Sanitizer) as a kernel-infoleak. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local code execution with a low-privilege user account on the target system (CVSS PR:L, AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 5.5 Medium (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects local, low-privilege access with high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with a standard unprivileged account on a vulnerable kernel version triggers the rseq exit path by spawning and terminating a process that has registered an rseq critical section (as glibc does by default). During process exit, `rseq_exit_user_update()` reads an uninitialized stack value for `ids.node_id`, potentially causing incorrect NUMA node lookups leading to a kernel panic, or leaking stale kernel stack bytes through the rseq interface. … |
| Remediation | Upgrade to Linux kernel 7.0.13 or later in the 7.0.x stable series, or apply the upstream fix commits e12d20a63b61aaf9de4772effccf42cc9a003e58 and 6d99479799c69c3cb588fcda19c81d8f61d64ecd available at https://git.kernel.org/stable/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today