EUVD-2026-66581
GHSA-ghc8-jmvh-q86v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Arch-local RISC-V kernel over-read reachable only via local code with specific alignment/page conditions (AV:L/PR:L/AC:H); effect is a fault/oops, so A:H with no confidentiality or integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
riscv: lib: Fix ZBB strnlen reading past count boundary
The ZBB-optimized strnlen loop loads one word ahead before checking the aligned boundary:
REG_L t1, SZREG(t0) // load next word addi t0, t0, SZREG // advance orc.b t1, t1 bgeu t0, t4, 4f // boundary check AFTER load
where t4 = (s + count) & -SZREG. When s is aligned and count is a multiple of SZREG, t4 equals s + count and the loop loads a full word starting at exactly s + count. If s + count falls on a page boundary with the next page unmapped, this faults.
Fix by computing the aligned boundary from the last valid byte (s + count - 1) instead of s + count. This makes the loop stop at the word containing the last valid byte rather than potentially loading the word after it. The count == 0 case is already handled by the beqz early exit.
Also add a pre-loop guard (bgeu t0, t4) for the case where all valid bytes fit within the first word. With the adjusted boundary, t4 can equal t0, and entering the loop with stale register state from the first-word processing would produce incorrect results.
The final minu clamp ensures the result is still correct when the last loaded word extends past s + count - 1 within the same aligned word.
AnalysisAI
Out-of-bounds read in the RISC-V ZBB-optimized strnlen() routine of the Linux kernel allows the aligned-word loop to load one machine word past the caller-supplied count boundary; when the source is aligned and count is a multiple of the register size, the extra load lands exactly at s+count and faults if that address sits on an unmapped page boundary. The affected code path only runs on RISC-V hardware exposing the Zbb bitmanip extension. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of: (1) a Linux kernel compiled for the RISC-V architecture with the Zbb-optimized strnlen assembly active; (2) a strnlen() call where the source pointer is SZREG-aligned and count is an exact multiple of SZREG, so the computed boundary equals s+count; and (3) the address s+count falling on a page boundary whose next page is unmapped, so the one-word over-read actually faults. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied signals conflict sharply and should not be taken at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a RISC-V system with the Zbb extension, kernel code calls strnlen() on an aligned buffer whose length is a multiple of the register size and which ends exactly at a page boundary with the following page unmapped; the optimized loop reads one word past the buffer and triggers a kernel page fault, producing an oops or panic. No public exploit exists, and because the triggering alignment/mapping conditions are largely incidental rather than attacker-controlled, weaponization for anything beyond a local denial of service is not demonstrated. |
| Remediation | Update to a kernel build that includes the upstream fix - Upstream fix available (stable commits e697e30f3dd2da3a1df7dc0980546d5b53aea4b6 and 5d588c684833e678a0008eb69c33190f01a65f4b); a specific released tag is not independently confirmed from the provided data, so pull the fix from your distribution's stable kernel update once it lands. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit infrastructure to identify any systems running RISC-V processors with Zbb bitmanip extension support. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today