Hello, there is a bug in the signal handling in arch/riscv/kernel/signal.c:
current->thread.vstate.vlenb is user-controlled data and must not be trusted without validation as it is here: https://github.com/spacemit-com/linux-6.18/blob/k3-br-v1.0.y/arch/riscv/kernel/signal.c#L148