{"cve":"CVE-2026-93167","nvd":{"published":"2026-09-17T17:18:12.243","modified":"2026-10-19T10:17:07.000","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncsky: Fix a4/a5 restoration in syscall trace path\n\nThe syscall trace path reloads syscall arguments from pt_regs before\ncalling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall\narguments are prepared as stack arguments before invoking syscallid.\n\nThe current code adjusts sp before loading LSAVE_A4 and LSAVE_A5. Since\nthose offsets are relative to the original pt_regs base, loading them\nafter changing sp fetches the wrong slots. As a result, traced syscalls\nthat use the 5th or 6th argument may receive corrupted arguments.\n\nThis is visible with mmap2(), which takes six arguments. A small\nPTRACE_SYSCALL reproducer opens a file and maps one page with:\n\n  mmap(NULL, 4096, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0)\n\nBefore the fix, the traced child fails the mmap and exits with 12.\nAfter the fix, the mapping succeeds and the child exits with 0.\n\nFix the trace path by loading a4/a5 from pt_regs before changing sp.\n\nTested on: ck860f, linux-4.19.15, C-SKY abiv2","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/31c81b376e5f058c7f2c94f69719cf7caec2fc3f","https://git.kernel.org/stable/c/343aa5275484d627c921a42e8e115cae366be5de","https://git.kernel.org/stable/c/64e3ec7a71d3b715e2567f19f64207f04999bb0c","https://git.kernel.org/stable/c/863fa63fd1491f201ac819f805a8db98d2a32c3d","https://git.kernel.org/stable/c/a776afa89424570bfa637ebf812ca281a5732904"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-93167","score":0.0022,"percentile":0.12352,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}