Executive brief
The Linux kernel's or1k_atomic syscall on OpenRISC systems fails to validate user-supplied memory pointers before performing read and write operations. An unprivileged local attacker can exploit this to read and write arbitrary kernel memory, potentially overwriting critical kernel structures to gain full code execution with kernel privileges.
Technical details
The sys_or1k_atomic() syscall (syscall 244 in the or1k ABI) takes two user pointers and swaps the words they point to via hand-written assembly. The vulnerability exists because the pointers are not validated with access_ok(), and the four memory access instructions lack exception table entries. An attacker can pass kernel addresses as either pointer, allowing direct reads and writes to kernel memory without privilege checks. This provides a kernel read/write primitive that can be leveraged to overwrite sys_call_table or other kernel data structures to achieve arbitrary code execution. The fix adds pointer range checks before the critical section and installs exception handlers for the memory access instructions to properly return -EFAULT for invalid addresses.
Affected products
- Linux Linux kernel OpenRISC architecture; patched in multiple kernel versions via commit 78004e9a87f240df03e2f73120d291763c32e0a7
Timeline
- 2026-09-11: disclosed: CVE-2026-89489 published
- 2026-09-14: patched: Fix committed to stable kernel branches via commit 78004e9a87f240df03e2f73120d291763c32e0a7