Executive brief
The Linux kernel's OpenRISC architecture implementation contains a privilege escalation flaw in signal handling. An unprivileged user can craft a specially crafted signal frame to disable memory protection features, gaining unrestricted read and write access to all physical memory. This allows a local attacker to completely bypass operating system security boundaries and take full control of the system.
Technical details
The vulnerability exists in the restore_sigcontext() function in arch/openrisc/kernel/signal.c, which restores CPU control bits from user-supplied signal frame data during signal return (rt_sigreturn). The code copies the entire Supervision Register (SR) from the signal frame and only clears the supervisor mode bit (SPR_SR_SM), leaving other privileged bits such as SPR_SR_DME (data MMU enable), SPR_SR_IME (instruction MMU enable), and cache control bits under user control. An unprivileged local process can disable the data MMU by clearing SPR_SR_DME in a crafted signal frame, which causes the CPU to perform no translation or protection on memory accesses, allowing arbitrary read/write to physical memory. The fix restricts user space to only modifying arithmetic flags (F, CY, OV) while kernel-owned privileged control bits are preserved from the saved kernel state. The patch has been committed upstream and backported to stable kernel versions.
Affected products
- Linux Linux kernel all versions with OpenRISC signal handling support
Timeline
- 2026-08-26: disclosed
- 2026-08-15: patched: Upstream patch 32ef1b30ad736519f7a207bcc2986f3d4129d972 committed by Stafford Horne