CVE-2025-39715
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-05

Last updated on: 2025-11-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: parisc: Revise gateway LWS calls to probe user read access We use load and stbys,e instructions to trigger memory reference interruptions without writing to memory. Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel and gateway page execute at privilege level 0, so this code never triggers a read access interruption. Thus, it is currently possible for user code to execute a LWS compare and swap operation at an address that is read protected at privilege level 3 (PRIV_USER). Fix this by probing read access rights at privilege level 3 and branching to lws_fault if access isn't allowed.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-05
Last Modified
2025-11-03
Generated
2026-05-27
AI Q&A
2025-09-05
EPSS Evaluated
2026-05-25
NVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel 6.1.153
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in the Linux kernel's parisc architecture involves improper handling of read access interruptions. Specifically, user code can execute a load-with-store-conditional (LWS) compare and swap operation at an address that should be read-protected at user privilege level (level 3). This happens because the kernel only triggers read access interruptions at privilege levels 2 and 3, but the kernel and gateway page run at privilege level 0, so the protection is bypassed. The fix involves checking read access rights at privilege level 3 and branching to a fault handler if access is not allowed.


How can this vulnerability impact me? :

This vulnerability could allow user-level code to perform operations on memory addresses that should be protected, potentially leading to unauthorized memory access or manipulation. This could compromise system security by allowing escalation of privileges or bypassing memory protection mechanisms.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart