CVE-2025-38434
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38434
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38434.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-38434
- Downstream
- Published
- 2025-07-25T14:32:08Z
- Modified
- 2025-10-18T04:37:54.713078Z
- Summary
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()"
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Revert "riscv: Define TASKSIZEMAX for _accessok()"
This reverts commit ad5643cf2f69 ("riscv: Define TASKSIZEMAX for _accessok()").
This commit changes TASKSIZEMAX to be LONGMAX to optimize accessok(), because the previous TASKSIZEMAX (default to TASK_SIZE) requires some computation.
The reasoning was that all user addresses are less than LONGMAX, and all kernel addresses are greater than LONGMAX. Therefore access_ok() can filter kernel addresses.
Addresses between TASKSIZE and LONGMAX are not valid user addresses, but access_ok() let them pass. That was thought to be okay, because they are not valid addresses at hardware level.
Unfortunately, one case is missed: getuserpagesfast() happily accepts addresses between TASKSIZE and LONGMAX. futex(), for instance, uses getuserpagesfast(). This causes the problem reported by Robert [1].
Therefore, revert this commit. TASKSIZEMAX is changed to the default: TASK_SIZE.
This unfortunately reduces performance, because TASKSIZE is more expensive to compute compared to LONGMAX. But correctness first, we can think about optimization later, if required.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedad5643cf2f699989daa85d909403febd6712fccbFixedfe30c30bf3bb68d4a4d8c7c814769857b5c973e6
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedad5643cf2f699989daa85d909403febd6712fccbFixedf8b1898748dfeb4f9b67b6a6d661f354b9de3523
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedad5643cf2f699989daa85d909403febd6712fccbFixed890ba5be6335dbbbc99af14ea007befb5f83f174