CVE-2025-38434: Revert "riscv: Define TASK_SIZE_MAX for __access_ok()"

Published Jul 25, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

Revert "riscv: Define TASKSIZEMAX for accessok()"

This reverts commit ad5643cf2f69 ("riscv: Define TASKSIZEMAX for accessok()").

This commit changes TASKSIZEMAX to be LONGMAX to optimize accessok(), because the previous TASKSIZEMAX (default to TASKSIZE) requires some computation.

The reasoning was that all user addresses are less than LONGMAX, and all kernel addresses are greater than LONGMAX. Therefore accessok() can filter kernel addresses.

Addresses between TASKSIZE and LONGMAX are not valid user addresses, but accessok() let them pass. That was thought to be okay, because they are not valid addresses at hardware level.

Unfortunately, one case is missed: getuserpagesfast() happily accepts addresses between TASKSIZE and LONGMAX. futex(), for instance, uses getuserpagesfast(). This causes the problem reported by Robert [1].

Therefore, revert this commit. TASKSIZEMAX is changed to the default: TASKSIZE.

This unfortunately reduces performance, because TASKSIZE is more expensive to compute compared to LONGMAX. But correctness first, we can think about optimization later, if required.

Affected Software

6 affected components
Linux Linux kernel
Linux Linux kernel>=6.10<6.12.36
Linux Linux kernel>=6.13<6.15.5
Linux Linux kernel=6.16-rc1
Linux Linux kernel=6.16-rc2
Linux Linux kernel=6.16-rc3

Event History

Jul 25, 2025
CVE Published
via MITRE·02:32 PM
Data Sourced
via MITRE·02:32 PM
DescriptionSeverity
Data Sourced
via NVD·03:15 PM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-38434?

CVE-2025-38434 is classified as a low-severity vulnerability in the Linux kernel.

2

How do I fix CVE-2025-38434?

To address CVE-2025-38434, update to the latest version of the Linux kernel where the vulnerability has been patched.

3

What are the potential impacts of CVE-2025-38434?

CVE-2025-38434 may lead to unexpected behavior in the access_ok() function in the Linux kernel.

4

Which versions of the Linux kernel are affected by CVE-2025-38434?

CVE-2025-38434 affects the Linux kernel versions prior to the fix being applied in the relevant commits.

5

Is CVE-2025-38434 remotely exploitable?

CVE-2025-38434 is not considered remotely exploitable but could impact local system integrity.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203