In the Linux kernel’s RISC‑V ptrace implementation, the routine that copies user‑supplied register data only writes the requested amount of bytes, leaving the remaining buffer space uninitialized. A short PTRACE_SETREGSET payload leaves garbage in the kernel buffer; this garbage is then validated and copied into the target process’s architectural state, including the shadow stack pointer. As a result, an attacker can alter the process’s execution context, potentially hijacking control flow or leaking privileged information.

All Linux kernel builds that include the RISC‑V arch ptrace code are susceptible. The patch resides in the mainline kernel, so any distribution shipping an upstream kernel with RISC‑V support prior to the commit referenced in the CVE is at risk. No specific version range is listed, but all kernels before the fix should be considered vulnerable.

The CVSS score of 3.3 indicates low overall severity, yet the flaw operates in kernel mode and can modify sensitive context. Exploitation requires the ability to issue a PTRACE_SETREGSET call on a target process; in practice, the likely attack vector is a local user who can send such a request to a traceable process. The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, implying public exploitation is unlikely at present. Nonetheless, the potential for privilege escalation on RISC‑V systems warrants early patching or mitigation.