CVE-2026-93167 - Vulnerability Details

- csky: Fix a4/a5 restoration in syscall trace path

Description

In the Linux kernel, the following vulnerability has been resolved:

csky: Fix a4/a5 restoration in syscall trace path

The syscall trace path reloads syscall arguments from pt_regs before
calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall
arguments are prepared as stack arguments before invoking syscallid.

The current code adjusts sp before loading LSAVE_A4 and LSAVE_A5. Since
those offsets are relative to the original pt_regs base, loading them
after changing sp fetches the wrong slots. As a result, traced syscalls
that use the 5th or 6th argument may receive corrupted arguments.

This is visible with mmap2(), which takes six arguments. A small
PTRACE_SYSCALL reproducer opens a file and maps one page with:

mmap(NULL, 4096, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0)

Before the fix, the traced child fails the mmap and exits with 12.
After the fix, the mapping succeeds and the child exits with 0.

Fix the trace path by loading a4/a5 from pt_regs before changing sp.

Tested on: ck860f, linux-4.19.15, C-SKY abiv2

Published: 2026-09-17

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel for C‑SKY ABIv2 incorrectly restores the fifth and sixth syscall arguments (a4 and a5) during the ptrace trace path. The code alters the stack pointer (sp) before reading these arguments from the pt_regs structure, which causes the values to be taken from the wrong offsets. As a result, any traced syscall that uses a4 or a5, such as mmap2 which requires six arguments, receives corrupted data. The corrupted arguments can cause the syscall to fail, leading to a traced child process exiting with an error code, effectively denying the traced workload its intended operation.

Affected Systems

Affected systems are Linux kernels that support C‑SKY ABIv2 instructions, including the ck860f board and kernel releases such as 4.19.15 and earlier versions that lack the patch. Any system that runs native or vendor‑supplied C‑SKY kernels and allows processes to be traced via ptrace is susceptible.

Risk and Exploitability

Risk and exploitability are low. Based on the description, the likely attack vector is local via ptrace, requiring local privilege to attach to target processes. The EPSS score is reported at less than 1 % and the vulnerability is not listed in the CISA KEV catalog. The impact is limited to disrupting the traced child rather than enabling arbitrary code execution or data exfiltration.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e0bbb53843b5fdfe464b099217e3b9d97e8a75d7`	affected	< e9ae8e86eed68bea5d2670eadf61938a43bd2263
`e0bbb53843b5fdfe464b099217e3b9d97e8a75d7`	affected	< 64e3ec7a71d3b715e2567f19f64207f04999bb0c
`e0bbb53843b5fdfe464b099217e3b9d97e8a75d7`	affected	< 863fa63fd1491f201ac819f805a8db98d2a32c3d
`e0bbb53843b5fdfe464b099217e3b9d97e8a75d7`	affected	< e71a3dc5b8d2ea4d9cfbdb135d6b7777de84212e
`e0bbb53843b5fdfe464b099217e3b9d97e8a75d7`	affected	< 31c81b376e5f058c7f2c94f69719cf7caec2fc3f
`e0bbb53843b5fdfe464b099217e3b9d97e8a75d7`	affected	< a776afa89424570bfa637ebf812ca281a5732904
`e0bbb53843b5fdfe464b099217e3b9d97e8a75d7`	affected	< 343aa5275484d627c921a42e8e115cae366be5de
`e0bbb53843b5fdfe464b099217e3b9d97e8a75d7`	affected	< abb81e5ce7d995baa41556b8125fa59e28ba3be8
`108681048cf728a8570e036c34ebd7daa43133b4`	affected	—
`3a5837c692918c229baf63fe7950965d27c48ac2`	affected	—
`5.4.47`	affected	< 5.5
`5.6.19`	affected	< 5.7

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e0bbb53843b5fdfe464b099217e3b9d97e8a75d7,e9ae8e86eed68bea5d2670eadf61938a43bd2263)`	affected	code_commit	—
`[e0bbb53843b5fdfe464b099217e3b9d97e8a75d7,64e3ec7a71d3b715e2567f19f64207f04999bb0c)`	affected	code_commit	—
`[e0bbb53843b5fdfe464b099217e3b9d97e8a75d7,863fa63fd1491f201ac819f805a8db98d2a32c3d)`	affected	code_commit	—
`[e0bbb53843b5fdfe464b099217e3b9d97e8a75d7,e71a3dc5b8d2ea4d9cfbdb135d6b7777de84212e)`	affected	code_commit	—
`[e0bbb53843b5fdfe464b099217e3b9d97e8a75d7,31c81b376e5f058c7f2c94f69719cf7caec2fc3f)`	affected	code_commit	—
`[e0bbb53843b5fdfe464b099217e3b9d97e8a75d7,a776afa89424570bfa637ebf812ca281a5732904)`	affected	code_commit	—
`[e0bbb53843b5fdfe464b099217e3b9d97e8a75d7,343aa5275484d627c921a42e8e115cae366be5de)`	affected	code_commit	—
`[e0bbb53843b5fdfe464b099217e3b9d97e8a75d7,abb81e5ce7d995baa41556b8125fa59e28ba3be8)`	affected	code_commit	—
`[108681048cf728a8570e036c34ebd7daa43133b4,*]`	affected	code_commit	—
`[3a5837c692918c229baf63fe7950965d27c48ac2,*]`	affected	code_commit	—
`[5.4.47,5.5)`	affected	semver	—
`[5.6.19,5.7)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.7,*]`	affected	semver	—
`[0,5.7)`	unaffected	semver	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a Linux kernel that includes the C‑SKY a4/a5 restoration patch (or apply the corresponding patch from the kernel commit URLs provided).
If immediate upgrade is not possible, manually cherry‑pick the patch to the running kernel source, rebuild, and install the updated kernel.
After applying the patch or new kernel, test the ptrace syscall path by running a sample tracer that performs mmap2() to confirm that the child no longer fails with an error.

Generated by OpenCVE AI on September 19, 2026 at 09:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/31c81b376e5f058c7f2c94f69719cf7caec2fc3f
https://git.kernel.org/stable/c/343aa5275484d627c921a42e8e115cae366be5de
https://git.kernel.org/stable/c/64e3ec7a71d3b715e2567f19f64207f04999bb0c
https://git.kernel.org/stable/c/863fa63fd1491f201ac819f805a8db98d2a32c3d
https://git.kernel.org/stable/c/a776afa89424570bfa637ebf812ca281a5732904
https://git.kernel.org/stable/c/abb81e5ce7d995baa41556b8125fa59e28ba3be8
https://git.kernel.org/stable/c/e71a3dc5b8d2ea4d9cfbdb135d6b7777de84212e
https://git.kernel.org/stable/c/e9ae8e86eed68bea5d2670eadf61938a43bd2263

History

Sat, 19 Sep 2026 09:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-703

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: csky: Fix a4/a5 restoration in syscall trace path The syscall trace path reloads syscall arguments from pt_regs before calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall arguments are prepared as stack arguments before invoking syscallid. The current code adjusts sp before loading LSAVE_A4 and LSAVE_A5. Since those offsets are relative to the original pt_regs base, loading them after changing sp fetches the wrong slots. As a result, traced syscalls that use the 5th or 6th argument may receive corrupted arguments. This is visible with mmap2(), which takes six arguments. A small PTRACE_SYSCALL reproducer opens a file and maps one page with: mmap(NULL, 4096, PROT_READ \| PROT_EXEC, MAP_PRIVATE, fd, 0) Before the fix, the traced child fails the mmap and exits with 12. After the fix, the mapping succeeds and the child exits with 0. Fix the trace path by loading a4/a5 from pt_regs before changing sp. Tested on: ck860f, linux-4.19.15, C-SKY abiv2
Title		csky: Fix a4/a5 restoration in syscall trace path
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/31c81b376e5f058c7f2c94f69719cf7caec2fc3f https://git.kernel.org/stable/c/343aa5275484d627c921a42e8e115cae366be5de https://git.kernel.org/stable/c/64e3ec7a71d3b715e2567f19f64207f04999bb0c https://git.kernel.org/stable/c/863fa63fd1491f201ac819f805a8db98d2a32c3d https://git.kernel.org/stable/c/a776afa89424570bfa637ebf812ca281a5732904 https://git.kernel.org/stable/c/abb81e5ce7d995baa41556b8125fa59e28ba3be8 https://git.kernel.org/stable/c/e71a3dc5b8d2ea4d9cfbdb135d6b7777de84212e https://git.kernel.org/stable/c/e9ae8e86eed68bea5d2670eadf61938a43bd2263

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:11:59.234Z

Updated: 2026-09-17T16:11:59.234Z

Reserved: 2026-09-17T16:02:15.090Z

Link: CVE-2026-93167

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:18:12.243

Modified: 2026-09-17T17:18:12.243

Link: CVE-2026-93167

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-19T17:45:17Z

Weaknesses

CWE-703
Improper Check or Handling of Exceptional Conditions

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object