CVE-2026-74751

A flaw was found in the Linux kernel's RISC-V (Reduced Instruction Set Computer - V) ZBB-optimized strnlen function. This vulnerability occurs because the strnlen loop attempts to read one word beyond the intended boundary. If the read operation crosses an unmapped memory page, it can lead to a system fault, resulting in a denial of service (DoS) for the affected system.

A moderate-impact flaw was found in the Linux kernel's RISC-V ZBB-optimized strnlen implementation. The optimized strnlen loop loads the next machine word before checking the aligned boundary, so when the input buffer is aligned and the byte count is a multiple of the register size, the loop can read one full word past the end of the supplied count. If that out-of-bounds read lands on a page boundary with the following page unmapped, it faults in kernel context, resulting in a denial of service. Triggering the fault requires a local process able to influence a kernel strnlen call with a specific buffer layout and memory mapping, which is why Red Hat Product Security rates this flaw Moderate (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with the impact limited to availability. This differs significantly from the CVE.org record, which scores the issue Critical (9.4) with a network attack vector and confidentiality and integrity impacts that the technical evidence does not support. All currently assessed Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams are marked not affected because the vulnerable RISC-V ZBB strnlen code is not present in the shipped kernels for those streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.