{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38261", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.997Z", "datePublished": "2025-07-09T10:42:36.810Z", "dateUpdated": "2026-08-05T12:00:49.085Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:00:49.085Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: save the SR_SUM status over switches\n\nWhen threads/tasks are switched we need to ensure the old execution's\nSR_SUM state is saved and the new thread has the old SR_SUM state\nrestored.\n\nThe issue was seen under heavy load especially with the syz-stress tool\nrunning, with crashes as follows in schedule_tail:\n\nUnable to handle kernel access to user memory without uaccess routines\nat virtual address 000000002749f0d0\nOops [#1]\nModules linked in:\nCPU: 1 PID: 4875 Comm: syz-executor.0 Not tainted\n5.12.0-rc2-syzkaller-00467-g0d7588ab9ef9 #0\nHardware name: riscv-virtio,qemu (DT)\nepc : schedule_tail+0x72/0xb2 kernel/sched/core.c:4264\n ra : task_pid_vnr include/linux/sched.h:1421 [inline]\n ra : schedule_tail+0x70/0xb2 kernel/sched/core.c:4264\nepc : ffffffe00008c8b0 ra : ffffffe00008c8ae sp : ffffffe025d17ec0\n gp : ffffffe005d25378 tp : ffffffe00f0d0000 t0 : 0000000000000000\n t1 : 0000000000000001 t2 : 00000000000f4240 s0 : ffffffe025d17ee0\n s1 : 000000002749f0d0 a0 : 000000000000002a a1 : 0000000000000003\n a2 : 1ffffffc0cfac500 a3 : ffffffe0000c80cc a4 : 5ae9db91c19bbe00\n a5 : 0000000000000000 a6 : 0000000000f00000 a7 : ffffffe000082eba\n s2 : 0000000000040000 s3 : ffffffe00eef96c0 s4 : ffffffe022c77fe0\n s5 : 0000000000004000 s6 : ffffffe067d74e00 s7 : ffffffe067d74850\n s8 : ffffffe067d73e18 s9 : ffffffe067d74e00 s10: ffffffe00eef96e8\n s11: 000000ae6cdf8368 t3 : 5ae9db91c19bbe00 t4 : ffffffc4043cafb2\n t5 : ffffffc4043cafba t6 : 0000000000040000\nstatus: 0000000000000120 badaddr: 000000002749f0d0 cause:\n000000000000000f\nCall Trace:\n[] schedule_tail+0x72/0xb2 kernel/sched/core.c:4264\n[] ret_from_exception+0x0/0x14\nDumping ftrace buffer:\n (ftrace buffer empty)\n---[ end trace b5f8f9231dc87dda ]---\n\nThe issue comes from the put_user() in schedule_tail\n(kernel/sched/core.c) doing the following:\n\nasmlinkage __visible void schedule_tail(struct task_struct *prev)\n{\n...\n if (current->set_child_tid)\n put_user(task_pid_vnr(current), current->set_child_tid);\n...\n}\n\nthe put_user() macro causes the code sequence to come out as follows:\n\n1:\t__enable_user_access()\n2:\treg = task_pid_vnr(current);\n3:\t*current->set_child_tid = reg;\n4:\t__disable_user_access()\n\nThe problem is that we may have a sleeping function as argument which\ncould clear SR_SUM causing the panic above. This was fixed by\nevaluating the argument of the put_user() macro outside the user-enabled\nsection in commit 285a76bb2cf5 (\"riscv: evaluate put_user() arg before\nenabling user access\")\"\n\nIn order for riscv to take advantage of unsafe_get/put_XXX() macros and\nto avoid the same issue we had with put_user() and sleeping functions we\nmust ensure code flow can go through switch_to() from within a region of\ncode with SR_SUM enabled and come back with SR_SUM still enabled. This\npatch addresses the problem allowing future work to enable full use of\nunsafe_get/put_XXX() macros without needing to take a CSR bit flip cost\non every access. Make switch_to() save and restore SR_SUM." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is the RISC-V context switch, reached only by executing code on the machine — ordinary syscalls such as clone(), read()/write() with partially-mapped buffers, or futex operations. There is no network-facing path to __switch_to.\nAC:L - The attacker controls both sides of the race: an unprivileged process can pin threads to a single CPU with sched_setaffinity and drive clone()/uaccess-heavy syscalls to force a context switch inside a SUM-enabled window, which is exactly the syz-stress workload that produced the reported oops. No condition depends on state outside the attacker's influence.\nPR:L - Only the ability to run unprivileged code is needed — the trigger paths (fork/clone reaching schedule_tail's put_user, copy_to_user/copy_from_user, futex) are available to any user with no capability, namespace, or filesystem gate. The original reporter's syz-executor process hit it as a plain unprivileged task.\nUI:N - The attacker triggers the condition entirely through their own syscalls and scheduling pressure. No victim action, mount, or file open is required.\nS:U - Both the vulnerable component and the impacted component are the kernel itself; although SUM leaks across task contexts, that remains within a single security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - A stale SR_SUM left set means kernel code in an unrelated task executes with S-mode access to U-mode pages enabled — the RISC-V SMAP equivalent disabled — which the maintainers explicitly labelled a vulnerability in the sibling fix c08b4848f596. Combined with attacker-controlled user mappings this yields an arbitrary kernel-side read primitive against attacker-authored data.\nI:H - The same protection bypass is symmetric: with SUM erroneously set, kernel stores to user-range addresses succeed silently, giving a write primitive that converts any kernel wild/NULL pointer dereference into controlled memory corruption and privilege escalation.\nA:H - The opposite direction — resuming with SUM unexpectedly cleared inside a uaccess window — reaches die_kernel_fault(\"access to user memory without uaccess routines\") in arch/riscv/mm/fault.c, the exact schedule_tail oops in the report. Dying in the scheduler tail destabilises the runqueue, and with panic_on_oops set it is an outright kernel panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/riscv/include/asm/processor.h", "arch/riscv/kernel/asm-offsets.c", "arch/riscv/kernel/entry.S" ], "versions": [ { "version": "76d2a0493a17d4c8ecc781366850c3c4f8e1a446", "lessThan": "69ea599a8dab93a620c92c255be4239a06290a77", "status": "affected", "versionType": "git" }, { "version": "76d2a0493a17d4c8ecc781366850c3c4f8e1a446", "lessThan": "788aa64c01f1262310b4c1fb827a36df170d86ea", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/riscv/include/asm/processor.h", "arch/riscv/kernel/asm-offsets.c", "arch/riscv/kernel/entry.S" ], "versions": [ { "version": "4.15", "status": "affected" }, { "version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.5", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.15.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/69ea599a8dab93a620c92c255be4239a06290a77" }, { "url": "https://git.kernel.org/stable/c/788aa64c01f1262310b4c1fb827a36df170d86ea" } ], "title": "riscv: save the SR_SUM status over switches", "x_generator": { "engine": "bippy-1.2.0" } } } }