CVE-2025-39716

Vulnerability

In the Linux kernel, the parisc architecture's __get_user() function does not trigger read access interruptions because it executes at privilege level 0, while interruptions only occur at levels 2 and 3. This allows a user to read from a read-protected address via a system call without triggering a fault.

Exploitation

An attacker with local user access to a parisc system can craft a system call that invokes __get_user() on a protected memory region. Since the kernel fails to generate a read access interruption, the read operation succeeds, bypassing the intended protection.

Impact

A local attacker can read arbitrary kernel memory that should be read-protected, potentially leaking sensitive information. The CVSS score of 5.5 (Medium) reflects this information disclosure.

Mitigation

The fix adds an explicit probe of read access rights at privilege level 3 (PRIV_USER) and sets __gu_err to -EFAULT if access is denied. The patch is applied in commits [2], [3], and [4] within the Linux kernel stable tree. Users should apply the latest kernel updates.