In the Linux kernel, the following vulnerability has been resolved:
riscv: Fix register corruption from uninitialized cregs on error
compatriscvgprset() calls cregstoregs() unconditionally, even when userregsetcopyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's ptregs, corrupting its register state and potentially leaking kernel stack contents.
compatrestoresigcontext() has the same issue: it calls cregstoregs() even when __copyfromuser() fails, leading to the same corruption of the signal-returning task's register state on error.
Only call cregstoregs() when the user copy succeeds.