Linux Kernel EUVD-2026-66581

Exploitation requires all of: (1) a Linux kernel compiled for the RISC-V architecture with the Zbb-optimized strnlen assembly active; (2) a strnlen() call where the source pointer is SZREG-aligned and count is an exact multiple of SZREG, so the computed boundary equals s+count; and (3) the address s+count falling on a page boundary whose next page is unmapped, so the one-word over-read actually faults. Limiting factors: the defect is architecture-local (RISC-V only, no network reachability despite the feed's AV:N), the count==0 and all-bytes-in-first-word cases are already handled, and the buffer alignment/length/page-adjacency alignment is generally determined by kernel callers rather than freely chosen by an attacker, making reliable triggering difficult outside of specifically crafted call sites.

The supplied signals conflict sharply and should not be taken at face value. The feed carries CVSS 9.4 with vector AV:N/AC:L/PR:N/UI:N/C:H/I:L/A:H, but the underlying defect is an architecture-specific kernel-internal read one word past a buffer - there is no network-reachable surface, and the observable effect described (loading an unmapped page) is a fault/oops, i.e. availability impact, not the high confidentiality the vector claims. AV:N and C:H are almost certainly automated over-scoring by the Linux CNA pipeline; a local vector with primarily availability impact is far more defensible. No EPSS score, KEV listing, SSVC decision, or POC is present in the data, and no CWE was assigned. Realistically this is a low-priority, RISC-V-only correctness/robustness fix: exploitation requires the vulnerable Zbb code path, a caller passing an aligned buffer with count a multiple of the register width, and that buffer ending precisely at an unmapped page boundary - conditions that arise incidentally rather than being attacker-steerable in most contexts. Treat the 9.4 as unreliable and prioritize by exposure to RISC-V systems, not by the headline number.

On a RISC-V system with the Zbb extension, kernel code calls strnlen() on an aligned buffer whose length is a multiple of the register size and which ends exactly at a page boundary with the following page unmapped; the optimized loop reads one word past the buffer and triggers a kernel page fault, producing an oops or panic. No public exploit exists, and because the triggering alignment/mapping conditions are largely incidental rather than attacker-controlled, weaponization for anything beyond a local denial of service is not demonstrated.