CVE-2025-38434: Revert "riscv: Define TASK_SIZE_MAX for __access_ok()"
In the Linux kernel, the following vulnerability has been resolved:
Revert "riscv: Define TASKSIZEMAX for accessok()"
This reverts commit ad5643cf2f69 ("riscv: Define TASKSIZEMAX for accessok()").
This commit changes TASKSIZEMAX to be LONGMAX to optimize accessok(), because the previous TASKSIZEMAX (default to TASKSIZE) requires some computation.
The reasoning was that all user addresses are less than LONGMAX, and all kernel addresses are greater than LONGMAX. Therefore accessok() can filter kernel addresses.
Addresses between TASKSIZE and LONGMAX are not valid user addresses, but accessok() let them pass. That was thought to be okay, because they are not valid addresses at hardware level.
Unfortunately, one case is missed: getuserpagesfast() happily accepts addresses between TASKSIZE and LONGMAX. futex(), for instance, uses getuserpagesfast(). This causes the problem reported by Robert [1].
Therefore, revert this commit. TASKSIZEMAX is changed to the default: TASKSIZE.
This unfortunately reduces performance, because TASKSIZE is more expensive to compute compared to LONGMAX. But correctness first, we can think about optimization later, if required.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38434?
CVE-2025-38434 is classified as a low-severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38434?
To address CVE-2025-38434, update to the latest version of the Linux kernel where the vulnerability has been patched.
What are the potential impacts of CVE-2025-38434?
CVE-2025-38434 may lead to unexpected behavior in the access_ok() function in the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2025-38434?
CVE-2025-38434 affects the Linux kernel versions prior to the fix being applied in the relevant commits.
Is CVE-2025-38434 remotely exploitable?
CVE-2025-38434 is not considered remotely exploitable but could impact local system integrity.