Executive brief
A vulnerability has been identified in the Linux kernel affecting systems using UltraSPARC III processors. The issue involves how the system handles data transfers between user applications and the core operating system. If an error occurs during these transfers, the system may report incorrect information, potentially leading to system instability or crashes (kernel panic).
Technical details
The vulnerability exists in the SPARC-specific implementation of copy_from_user and copy_to_user within arch/sparc/lib/U3memcpy.S. The root cause is a logic error where register %o2 (representing the length of data to copy) was masked after the bulk copy loop rather than during it. Consequently, if a fault occurs during the bulk copy, the exception handler calculates an impossibly large return value for the number of bytes remaining. This incorrect return value propagates to callers like __copy_from_iter(), triggering BUG_ON assertions in kernel components such as the ext4 filesystem driver when large folios are enabled. The fix involves moving the masking operation earlier in the assembly routine to ensure accurate register state for exception handlers.
Affected products
- Linux Linux Kernel 4.4.34 to 4.5, 4.8.10 to 4.9, and subsequent versions prior to the fix commits
Timeline
- 2025-09-05: disclosed: Initial patch submitted by Michael Karcher
- 2025-10-29: patched: Patch committed to stable tree
- 2025-11-12: advisory: CVE-2025-40124 published
References
- https://git.kernel.org/stable/c/1198077606aeffb102587c6ea079ce99641c99d4
- https://git.kernel.org/stable/c/1857cdca12c4aff58bf26a7005a4d02850c29927
- https://git.kernel.org/stable/c/47b49c06eb62504075f0f2e2227aee2e2c2a58b3
- https://git.kernel.org/stable/c/5ef9c94d7110e90260c06868cf1dcf899b9f25ee
- https://git.kernel.org/stable/c/91eda032eb16e5d2be27c95584665bc555bb5a90
- https://git.kernel.org/stable/c/dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e
- https://git.kernel.org/stable/c/e50377c6b3f278c9f3ef017ffce17f5fcc9dace4