CVE-2025-39716: parisc: Revise __get_user() to probe user read access
In the Linux kernel, the following vulnerability has been resolved:
parisc: Revise getuser() to probe user read access
Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel executes at privilege level 0, so getuser() never triggers a read access interruption (code 26). Thus, it is currently possible for user code to access a read protected address via a system call.
Fix this by probing read access rights at privilege level 3 (PRIVUSER) and setting guerr to -EFAULT (-14) if access isn't allowed.
Note the cmpiclr instruction does a 32-bit compare because COND macro doesn't work inside asm.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.104.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39716?
CVE-2025-39716 has been assigned a severity level that indicates it poses a risk due to improper read access handling.
How do I fix CVE-2025-39716?
To fix CVE-2025-39716, you need to apply the latest updates to the Linux kernel as recommended by your distribution.
What systems are affected by CVE-2025-39716?
CVE-2025-39716 affects systems running specific versions of the Linux kernel related to parisc architecture.
What type of vulnerability is CVE-2025-39716?
CVE-2025-39716 is a vulnerability that involves improper handling of user read access in the Linux kernel.
Is CVE-2025-39716 publicly known?
Yes, CVE-2025-39716 is a publicly disclosed vulnerability in the Linux kernel.