Junglewise Threat Intelligence

CVE-2025-39716: Linux Kernel read protection bypass in PA-RISC __get_user

CVE-2025-39716 · Severity: medium · CVSS 5.5 · Published 2025-09-05

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's handling of memory access on PA-RISC architectures could allow a local user to bypass certain read protections. By using system calls, an attacker might access memory addresses that should normally be restricted. This could lead to system instability or unauthorized access to sensitive information within the operating system environment.

Technical details

A vulnerability exists in the Linux kernel's PA-RISC architecture support where the __get_user() macro fails to enforce read access protections. On PA-RISC, read access interruptions (code 26) are only triggered at privilege levels 2 and 3; because the kernel operates at privilege level 0, it bypasses these hardware checks. This allows a local attacker to use system calls to read from memory addresses that are otherwise protected from user-level access. The fix involves explicitly probing read access rights at privilege level 3 (PRIV_USER) using the 'proberi' instruction and returning -EFAULT if access is denied. Patches have been released for various stable kernel branches including 6.1, 6.6, 6.12, and 6.16.

Affected products

  • Linux Linux Kernel v5.12+

Timeline

  • 2025-09-05: disclosed: Initial publication of the CVE record.
  • 2025-08-28: patched: Commits merged into stable kernel branches.

References

Related threats