EUVD-2026-76395
GHSA-9rpr-c8j9-pwgc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local unprivileged access to an OpenRISC host required; kernel is both vulnerable and impacted component, so no scope change applies.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly.
l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29
The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries.
A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly.
This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context.
Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT.
[shorne@gmail.com: fix comment style]
AnalysisAI
Arbitrary kernel memory read/write in the Linux kernel's OpenRISC architecture syscall handler allows an unprivileged local process to overwrite kernel structures such as the sys_call_table and achieve kernel-context code execution. The sys_or1k_atomic() function (syscall 244 in the or1k ABI) performs a hand-written assembly atomic word swap between two user-supplied pointers without calling access_ok(), and its four memory-access instructions lack exception table entries - meaning any kernel address passed by a caller is directly dereferenced without fault isolation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local code execution as an unprivileged user (any normal account) on a Linux kernel compiled with OpenRISC (or1k) architecture support - the vulnerability is entirely confined to this architecture and does not affect any other platform. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is accurately calibrated for a local privilege escalation: the attacker must already hold a low-privileged shell on an OpenRISC Linux host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 6.12.109, 6.18.50, 7.2.4, or apply the 7.3-rc1 tree which includes the fix adding `access_ok()` validation before the critical section and exception table fixups for all four memory instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, determine whether OpenRISC systems exist in your infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today