Unknown

CVE-2026-93167 — csky: Fix a4/a5 restoration in syscall trace path

In the Linux kernel, the following vulnerability has been resolved: csky: Fix a4/a5 restoration in syscall trace path The syscall trace path reloads syscall arguments from pt_regs before calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall arguments are prepared as stack arguments before invoking syscallid. The current code adjusts sp before loading LSAVE_A4 and LSAVE_A5. Since those offsets are relative to the original pt_regs base, loading them after changing sp fetches the wrong slots. As a result, traced syscalls that use the 5th or 6th argument may receive corrupted arguments. This is visible with mmap2(), which takes six arguments. A small PTRACE_SYSCALL reproducer opens a file and maps one page with: mmap(NULL, 4096, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0) Before the fix, the traced child fails the mmap and exits with 12. After the fix, the mapping succeeds and the child exits with 0. Fix the trace path by loading a4/a5 from pt_regs before changing sp. Tested on: ck860f, linux-4.19.15, C-SKY abiv2

Published Sep 17, 2026 · Updated Oct 15, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

EPSS 0.2% (30-day exploitation probability)+2

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

0.22%

ahead of 12% of scored CVEs · Oct 15, 2026

Affects

Linux

CVSS base

—

Score not published yet.

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
No fix documented in the sources: reduce exposure and monitor the vendor advisory.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	≥ e0bbb53843b5fdfe464b099217e3b9d97e8a75d7 and < e9ae8e86eed68bea5d2670eadf61938a43bd2263≥ e0bbb53843b5fdfe464b099217e3b9d97e8a75d7 and < 64e3ec7a71d3b715e2567f19f64207f04999bb0c≥ e0bbb53843b5fdfe464b099217e3b9d97e8a75d7 and < 863fa63fd1491f201ac819f805a8db98d2a32c3d≥ e0bbb53843b5fdfe464b099217e3b9d97e8a75d7 and < e71a3dc5b8d2ea4d9cfbdb135d6b7777de84212e≥ e0bbb53843b5fdfe464b099217e3b9d97e8a75d7 and < 31c81b376e5f058c7f2c94f69719cf7caec2fc3f≥ e0bbb53843b5fdfe464b099217e3b9d97e8a75d7 and < a776afa89424570bfa637ebf812ca281a5732904≥ e0bbb53843b5fdfe464b099217e3b9d97e8a75d7 and < 343aa5275484d627c921a42e8e115cae366be5de≥ e0bbb53843b5fdfe464b099217e3b9d97e8a75d7 and < abb81e5ce7d995baa41556b8125fa59e28ba3be8 and 5 more version 108681048cf728a8570e036c34ebd7daa43133b4version 3a5837c692918c229baf63fe7950965d27c48ac2≥ 5.4.47 and < 5.5≥ 5.6.19 and < 5.7version 5.7	Vulnerable	CVE Program (cve.org) e CISA ADP

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Not enough vector or weakness data: use the affected application’s logs as a starting point.

application logs

Timeline

What happened to this CVE, newest first.

2026
Record published
Oct 15, 2026
Affected products added · linux/linux
Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
Source status changed · → Received
Oct 15, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 15, 2026 · NIST National Vulnerability Database
CVE published
Sep 17, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

1× Official description updated · Oct 15, 2026 – Oct 15, 2026

References

8 on the record

git.kernel.org/stable/c/343aa5275484d627c921a42e8e115cae366be5de
NIST National Vulnerability Database
git.kernel.org/stable/c/64e3ec7a71d3b715e2567f19f64207f04999bb0c
NIST National Vulnerability Database
git.kernel.org/stable/c/863fa63fd1491f201ac819f805a8db98d2a32c3d
NIST National Vulnerability Database
git.kernel.org/stable/c/e9ae8e86eed68bea5d2670eadf61938a43bd2263
NIST National Vulnerability Database
git.kernel.org/stable/c/a776afa89424570bfa637ebf812ca281a5732904
NIST National Vulnerability Database
git.kernel.org/stable/c/e71a3dc5b8d2ea4d9cfbdb135d6b7777de84212e
NIST National Vulnerability Database
git.kernel.org/stable/c/31c81b376e5f058c7f2c94f69719cf7caec2fc3f
NIST National Vulnerability Database
git.kernel.org/stable/c/abb81e5ce7d995baa41556b8125fa59e28ba3be8
NIST National Vulnerability Database

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Critical CVE-2026-99999 ipv4: validate checksum_start before completing checksum 1d
Unknown CVE-2026-98432 ipv4: free inet_opt and ireq_opt after an RCU grace period 1d
Unknown CVE-2026-98424 wifi: cfg80211: undo netns switch if renaming the wiphy fails 1d
Unknown CVE-2026-98425 wifi: mac80211: don't warn when an IBSS has no channel to scan 1d
Unknown CVE-2026-98426 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 1d
Unknown CVE-2026-98427 net/sched: codel: bound the dropping loop per dequeue call 1d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CVSS score published by NVD, the CNA, CISA or GitHub so far.
No fixed version, patch or mitigation documented.
No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-93167 is "csky: Fix a4/a5 restoration in syscall trace path", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. EPSS 0.22% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.