Linux Kernel EUVD-2026-45655

The flaw lives in the RISC-V architecture's COMPAT support, which lets a 64-bit riscv kernel run 32-bit (ILP32) userspace. Both affected functions declare a local 'cregs' structure on the stack, populate it from userspace via user_regset_copyin() (ptrace regset path) or __copy_from_user() (signal-return path), and then translate it into the kernel's native pt_regs via cregs_to_regs(). Because cregs_to_regs() is invoked unconditionally, a failed copy leaves cregs holding whatever residual data was previously on the kernel stack, which is then committed into the task's saved register file. This is a classic use-of-uninitialized-stack-variable defect (CWE-457 / CWE-908) whose security consequence is an information-disclosure primitive (CWE-200), since the leaked kernel stack bytes become readable in the returning task's GPRs. CPE data identifies the affected product only generically as cpe:2.3:a:linux:linux, with the true scope being kernels built with CONFIG_RISCV and CONFIG_COMPAT.