---
id: CVE-2026-93266
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  arm64: RSI: fix field-spanning write warning in attestation token init

  The challenge is passed in registers a1 through a8
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  arm64: RSI: fix field-spanning write warning in attestation token init

  The challenge is passed in registers a1 through a8. However, copying to
  &regs.a1 makes FORTIFY t…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b880a80011f56880f32bde47fc6af313359f926b <
    e505092cb200d430d5b8d8d3e926d45f29474ba3
  - >-
    Linux >= b880a80011f56880f32bde47fc6af313359f926b <
    d29a8ee271da17b5e32d7a76a9c78d43f66447ca
  - >-
    Linux >= b880a80011f56880f32bde47fc6af313359f926b <
    221049874b6a78c7d87bc826581b0695cd338e2b
  - Linux 6.13
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T16:17:23.453'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93266'
references:
  - url: 'https://git.kernel.org/stable/c/221049874b6a78c7d87bc826581b0695cd338e2b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d29a8ee271da17b5e32d7a76a9c78d43f66447ca'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e505092cb200d430d5b8d8d3e926d45f29474ba3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T16:47:15.837Z'
epss: 0.00184
epssPercentile: 0.07115
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

arm64: RSI: fix field-spanning write warning in attestation token init

The challenge is passed in registers a1 through a8. However, copying to
&regs.a1 makes FORTIFY treat the destination as the single a1 field,
resulting in a field-spanning write warning. [1]

Overlay the SMCCC register structure with an RSI-specific argument
layout and copy the challenge into an explicit 64-byte array. This keeps
the existing a1-a8 argument encoding while giving the copy a correctly
sized destination object.

[1]
memcpy: detected field-spanning write (size 64) of single field "&regs.a1" at ./arch/arm64/include/asm/rsi_cmds.h:119 (size 8)
WARNING: ./arch/arm64/include/asm/rsi_cmds.h:119 at rsi_attestation_token_init+0xdc/0xf8 [arm_cca_guest], CPU#0: cat/3314

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.