CVE-2025-38434

Source
https://cve.org/CVERecord?id=CVE-2025-38434
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38434.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38434
Downstream
Published
2025-07-25T14:32:08.089Z
Modified
2026-03-20T12:42:51.306628Z
Summary
Revert "riscv: Define TASK_SIZE_MAX for __access_ok()"
Details

In the Linux kernel, the following vulnerability has been resolved:

Revert "riscv: Define TASKSIZEMAX for _accessok()"

This reverts commit ad5643cf2f69 ("riscv: Define TASKSIZEMAX for _accessok()").

This commit changes TASKSIZEMAX to be LONGMAX to optimize accessok(), because the previous TASKSIZEMAX (default to TASK_SIZE) requires some computation.

The reasoning was that all user addresses are less than LONGMAX, and all kernel addresses are greater than LONGMAX. Therefore access_ok() can filter kernel addresses.

Addresses between TASKSIZE and LONGMAX are not valid user addresses, but access_ok() let them pass. That was thought to be okay, because they are not valid addresses at hardware level.

Unfortunately, one case is missed: getuserpagesfast() happily accepts addresses between TASKSIZE and LONGMAX. futex(), for instance, uses getuserpagesfast(). This causes the problem reported by Robert [1].

Therefore, revert this commit. TASKSIZEMAX is changed to the default: TASK_SIZE.

This unfortunately reduces performance, because TASKSIZE is more expensive to compute compared to LONGMAX. But correctness first, we can think about optimization later, if required.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38434.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ad5643cf2f699989daa85d909403febd6712fccb
Fixed
fe30c30bf3bb68d4a4d8c7c814769857b5c973e6
Fixed
f8b1898748dfeb4f9b67b6a6d661f354b9de3523
Fixed
890ba5be6335dbbbc99af14ea007befb5f83f174

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38434.json"