Skip to main content

Linux Kernel EUVDEUVD-2026-40985

| CVE-2026-53351 MEDIUM
2026-07-01 Linux GHSA-6c65-27vf-g68r
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access on RISC-V hardware required; low-privilege user triggers via normal process crash with no confidentiality or integrity effect, only availability disruption.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 22, 2026 - 20:45 vuln.today
CVSS changed
Jul 22, 2026 - 19:22 NVD
5.5 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI

Fixes a warning while dumping core:

[54983.546369][ C7] WARNING: [!note_name] fs/binfmt_elf.c:1771 at elf_core_dump+0x910/0xf68, CPU#7: abort01/31982

AnalysisAI

Core dump handling in the Linux kernel's RISC-V ptrace subsystem emits a kernel warning and disrupts crash reporting due to REGSET_CFI missing USER_REGSET_NOTE_TYPE. Affected kernels (7.0 through pre-patch 7.1 on RISC-V) trigger the warning at fs/binfmt_elf.c:1771 whenever a process core dumps with CFI register state present. Any low-privileged local user on a RISC-V host can trigger this condition; no public exploit exists and EPSS sits at 0.14%, indicating no practical threat beyond the operational disruption of broken core dumps.

Technical ContextAI

The flaw resides in the RISC-V architecture-specific ptrace register set implementation within the Linux kernel. REGSET_CFI (Control Flow Integrity registers, associated with RISC-V CFI extension support) was not configured with USER_REGSET_NOTE_TYPE, which is required for ELF core dump note generation. When elf_core_dump in fs/binfmt_elf.c iterates over register sets to write ELF notes, it expects each register set to carry a valid note_name; without USER_REGSET_NOTE_TYPE, the assertion at line 1771 fires and emits a WARN_ON. The CWE is not formally assigned, but the root cause is a configuration omission in an enumeration or flag field within a kernel data structure - not a memory-safety or logic vulnerability. Affected CPEs are cpe:2.3:a:linux:linux on versions spanning 7.0 through 7.1 pre-patch, per EUVD-2026-40985.

RemediationAI

Upgrade to Linux kernel 7.0.13 or later in the 7.0.x stable series, or apply upstream fix commits 08200bef0983ffed039ab399df0cba8d900ce5fc and e3573f739e3dadab57ec80488d07e05c8f6e82d3 from https://git.kernel.org/stable/c/ to the relevant branches. For 7.1.x, verify inclusion of those commits in the release changelog before deploying. Distribution-packaged RISC-V kernels (Debian, Fedora, Ubuntu RISC-V ports) should apply their respective kernel security updates once backports land. As a compensating control where patching is not immediately feasible, disabling core dumps system-wide via ulimit -c 0 in /etc/security/limits.conf suppresses the triggering code path entirely; the trade-off is loss of all crash forensic capability on affected hosts. No kernel parameter or sysctl can selectively disable REGSET_CFI note emission without the patch.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-40985 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy