CVE-2026-80560

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> openrisc: signal: do not restore privileged SR bits on sigreturn<br /> <br /> restore_sigcontext() copies the whole supervision register (SR) from the<br /> signal frame and only clears SPR_SR_SM before the value is reloaded into<br /> the hardware SR (through ESR and l.rfe) on the return to user space. All<br /> other SR bits are left under user control.<br /> <br /> An unprivileged task can thus return from a signal handler through a<br /> crafted sigframe that clears SPR_SR_DME. With the data MMU disabled the<br /> CPU performs no translation or protection on data accesses, so the task<br /> gains read and write access to arbitrary physical memory, a local<br /> privilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH<br /> and the cache-enable bits are exposed the same way. The ptrace GPR regset<br /> already refuses any change to SR for exactly this reason.<br /> <br /> Restore only the arithmetic flag bits (F, CY, OV) from the signal frame<br /> and take every privileged control bit from the SR the kernel saved on<br /> signal entry.<br /> <br /> Verified with qemu-system-or1k -M or1k-sim: before this change an<br /> unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to<br /> physical address 0x03000000 (beyond the kernel&amp;#39;s mem=32M); afterwards the<br /> same PoC receives SIGSEGV and physical memory is unchanged.