Executive brief
A vulnerability in the Linux kernel's SPARC architecture support could allow a local user to cause a system crash or potentially gain unauthorized access to data. The issue exists in the way the system handles memory transfers between user applications and the core operating system on Niagara-based processors. If a memory error occurs during these transfers, the system may perform incorrect calculations, leading to instability or security breaches.
Technical details
The vulnerability stems from incorrect calculations and a broken epilogue in the exception handlers for 'copy_from_user' and 'copy_to_user' within the SPARC architecture (specifically Niagara/NGmemcpy.S). When a fault occurs during a user-space memory reference, the handler fails to accurately calculate the remaining bytes to copy based on current register contents. This logic error can result in kernel crashes or the return of incorrect status values to the caller, which may lead to further memory corruption or logic bypasses. The issue is triggered locally during standard memory copy operations between user and kernel space. Patches have been released across multiple stable Linux kernel branches.
Affected products
- Linux Linux 4.4.34 to 4.5; 4.8.10 to 4.9; 4.9 and later versions prior to fix
Timeline
- 2025-11-12: advisory: CVE-2025-40112 published by kernel.org
References
- https://git.kernel.org/stable/c/05440320ea3e249d5f984918f2bf51210c1a7c03
- https://git.kernel.org/stable/c/088c5098ec6d6b0396edfbf3dad3e81de8469c1c
- https://git.kernel.org/stable/c/0b67c8fc10b13a9090340c5f8a37d308f4e1571c
- https://git.kernel.org/stable/c/37547d8e6eba87507279ee3dfddfd9dc46335454
- https://git.kernel.org/stable/c/7823fc4d8ab5e57f8db7806ff2530c03c166c4bb
- https://git.kernel.org/stable/c/8cdeb5e482d3fdce7e825444b6ca3865e24c0228
- https://git.kernel.org/stable/c/a365ee556e45f780ee322b349a06efdad0c1458f