The vulnerability arises in the Linux kernel for RISC‑V when the compat_riscv_gpr_set and compat_restore_sigcontext functions call cregs_to_regs unconditionally, even if the preceding copy from user space fails. Because the cregs structure is an uninitialized stack variable, a failure writes stale or garbage data into a task’s pt_regs register state. This corrupts the target process’s registers and may leak portions of the kernel stack, exposing sensitive information or destabilizing a process. This issue represents CWE‑824: Use of Uninitialized Variable.

All Linux kernels that include RISC‑V support and have not yet received the patch are vulnerable. This applies to all distributions that ship the affected kernel revision, regardless of vendor or distribution version, until a patched kernel is deployed.

The CVSS score of 7.8 classifies the issue as high severity, while the EPSS score of less than 1% indicates a low probability of widespread exploitation at this time. The flaw is not listed in the CISA KEV catalog, and no public exploits are known. Exploitation would likely require local execution or the ability to trigger the compatibility interfaces that invoke the faulty copy operations, which normally suggests a local user threat. In the absence of confirmed exploitation, the immediate risk remains moderate, but the potential for confidential data leakage or process instability persists if the flaw is leveraged.