CVE-2026-89489

A flaw was found in the Linux kernel. The sys_or1k_atomic() syscall, specific to the openrisc architecture, does not adequately validate user-provided pointers. An unprivileged process can exploit this by supplying kernel addresses to the syscall, gaining unauthorized read and write access to kernel memory. This vulnerability allows an attacker to overwrite critical kernel data, potentially leading to arbitrary code execution with elevated privileges.

This vulnerability is rated as Moderate because exploitation is constrained to the OpenRISC (or1k) architecture and requires local unprivileged code execution. Red Hat enterprise products do not support or compile kernels for OpenRISC platforms, meaning the vulnerable code is not included in standard Red Hat Enterprise Linux environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.