CVE-2025-40124

Vulnerability

Vulnerability

In the Linux kernel, a flaw in the SPARC architecture's copy_from_user and copy_to_user functions for UltraSPARC III processors causes exception handlers to return values that can be impossibly large—greater than the requested copy size. This occurs because exception handlers, which calculate remaining bytes after a fault, rely on register %o2 being masked during the bulk copy loop, but the masking step is performed after the loop completes. As a result, when a faulting copies return incorrect byte counts.

Exploitation

An attacker does not require authentication or special privileges; any user-space program that triggers a page fault during a copy operation can cause the kernel to return a wrong value. The bug is triggered when a user-space buffer is not fully accessible, the kernel's exception handler incorrectly computes the number of bytes not copied, leading to a value that may exceed the original length. This can be triggered by normal file operations, such as reading from ext4 filesystem with large folios enabled.

Impact

An attacker who can cause a copy_from_user to fault can make the kernel believe that more data was copied than actually was. This can lead to memory corruption in filesystem code (e.g., ext4) that trusts the return value, potentially causing data corruption or system crashes. The bug was discovered because it triggered a BUG_ON in ext4 code with large folios.

Mitigation

Patches are available in the stable kernel tree [1][2][3]. Users should update to the latest stable kernel version that includes the fix. No workaround is available; the only mitigation is to apply the kernel update.