CVE-2026-80560

A flaw was found in the Linux kernel, specifically within the openrisc architecture's signal handling. An unprivileged local attacker can exploit a vulnerability in the restore_sigcontext() function by crafting a malicious signal frame. This allows the attacker to disable the Data Memory Management Unit (MMU), gaining unauthorized read and write access to arbitrary physical memory. This ultimately leads to a local privilege escalation.

A moderate severity local privilege escalation flaw was found in the Linux kernel's signal handling on the openrisc architecture. When returning from a signal handler, restore_sigcontext() copies the entire supervision register (SR) from the user-controlled signal frame and clears only the supervisor-mode bit (SPR_SR_SM) before the value is reloaded into the hardware SR. A local unprivileged attacker could exploit this by returning from a signal handler through a crafted signal frame that clears the data MMU enable bit (SPR_SR_DME). With the data MMU disabled, the CPU performs no address translation or protection on data accesses, allowing the attacker to read and write arbitrary physical memory and fully compromise the system. The instruction MMU enable bit (SPR_SR_IME) and other privileged SR control bits are exposed in the same way.

The vulnerable code is specific to the openrisc architecture port and is not present in the kernel packages that Red Hat ships. All Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS (kernel and kernel-ivos-qualcomm) streams are therefore not affected by this flaw, and no Red Hat update is required.

While the CVE.org record rates this flaw as Important with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), Red Hat rates it as Moderate with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.