{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-40124", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.169Z", "datePublished": "2025-11-12T10:23:19.861Z", "dateUpdated": "2026-08-05T12:07:57.197Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:57.197Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III\n\nAnthony Yznaga tracked down that a BUG_ON in ext4 code with large folios\nenabled resulted from copy_from_user() returning impossibly large values\ngreater than the size to be copied. This lead to __copy_from_iter()\nreturning impossible values instead of the actual number of bytes it was\nable to copy.\n\nThe BUG_ON has been reported in\nhttps://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de\n\nThe referenced commit introduced exception handlers on user-space memory\nreferences in copy_from_user and copy_to_user. These handlers return from\nthe respective function and calculate the remaining bytes left to copy\nusing the current register contents. The exception handlers expect that\n%o2 has already been masked during the bulk copy loop, but the masking was\nperformed after that loop. This will fix the return value of copy_from_user\nand copy_to_user in the faulting case. The behaviour of memcpy stays\nunchanged." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The fault must occur inside a `copy_{from,to}_user()` on a buffer in the attacker's own address space, which requires local `mmap`/`munmap`/`mprotect` control plus a local syscall entry (write(2), ioctl(2), etc.). No remote peer can cause a user-copy fault at a chosen offset.\nAC:L - Every precondition is deterministic and attacker-chosen: length ≥ 192 selects the VIS block-copy path, dst/src alignment is controllable, and the fault offset is placed exactly by unmapping or PROT_NONE-ing a page of the source buffer. There is no race and no dependence on unpredictable memory layout.\nPR:L - Any unprivileged local user can trigger this with ordinary `write(2)`/`read(2)`/`ioctl(2)` plus `mmap`/`munmap`; no capability, namespace trick, or privileged device access is required.\nUI:N - The attacking process performs the entire sequence itself — mapping the partially-valid buffer and issuing the syscall. No victim action is involved.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The over-reported count underflows `iterate_iovec()`/`iterate_ubuf()` accounting, causing the iterator to walk past the end of the kernel iovec array and treat arbitrary kernel memory as iovec descriptors, and the resulting heap corruption primitive can be leveraged for kernel memory disclosure.\nI:H - `_inline_copy_from_user()`'s tail `memset(to + (n - res), 0, res)` with `res > n` wraps the pointer and zeroes up to ~n bytes of kernel heap memory *before* the destination buffer — an attacker-sized out-of-bounds write (4 KB underflow for a 4 KB copy) into adjacent slab objects, a well-known privilege-escalation primitive.\nA:H - The bug was reported as a hard `BUG_ON` panic in ext4's large-folio write path, and the `size_t` underflow of `iter->count`/`len` also drives runaway iteration loops — both are full kernel denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/sparc/lib/U3memcpy.S" ], "versions": [ { "version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "fdd43fe6d286f27b826572457a89c926f97e2d3a", "status": "affected", "versionType": "git" }, { "version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "1198077606aeffb102587c6ea079ce99641c99d4", "status": "affected", "versionType": "git" }, { "version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "1857cdca12c4aff58bf26a7005a4d02850c29927", "status": "affected", "versionType": "git" }, { "version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "91eda032eb16e5d2be27c95584665bc555bb5a90", "status": "affected", "versionType": "git" }, { "version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e", "status": "affected", "versionType": "git" }, { "version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "5ef9c94d7110e90260c06868cf1dcf899b9f25ee", "status": "affected", "versionType": "git" }, { "version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "e50377c6b3f278c9f3ef017ffce17f5fcc9dace4", "status": "affected", "versionType": "git" }, { "version": "ee841d0aff649164080e445e84885015958d8ff4", "lessThan": "47b49c06eb62504075f0f2e2227aee2e2c2a58b3", "status": "affected", "versionType": "git" }, { "version": "1c7e17b1c4d60cc5aa575460f7efb73686dd3b39", "status": "affected", "versionType": "git" }, { "version": "ac663c54f40b2830b1ca32d1ae9d683fe248b14c", "status": "affected", "versionType": "git" }, { "version": "4.4.34", "lessThan": "4.5", "status": "affected", "versionType": "semver" }, { "version": "4.8.10", "lessThan": "4.9", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/sparc/lib/U3memcpy.S" ], "versions": [ { "version": "4.9", "status": "affected" }, { "version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.301", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.246", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.195", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.156", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.112", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.53", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.3", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.4.301" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.246" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.195" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.156" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.112" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.53" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.17.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.34" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/fdd43fe6d286f27b826572457a89c926f97e2d3a" }, { "url": "https://git.kernel.org/stable/c/1198077606aeffb102587c6ea079ce99641c99d4" }, { "url": "https://git.kernel.org/stable/c/1857cdca12c4aff58bf26a7005a4d02850c29927" }, { "url": "https://git.kernel.org/stable/c/91eda032eb16e5d2be27c95584665bc555bb5a90" }, { "url": "https://git.kernel.org/stable/c/dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e" }, { "url": "https://git.kernel.org/stable/c/5ef9c94d7110e90260c06868cf1dcf899b9f25ee" }, { "url": "https://git.kernel.org/stable/c/e50377c6b3f278c9f3ef017ffce17f5fcc9dace4" }, { "url": "https://git.kernel.org/stable/c/47b49c06eb62504075f0f2e2227aee2e2c2a58b3" } ], "title": "sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III", "x_generator": { "engine": "bippy-1.2.0" } } } }