CVE-2025-40124 (GCVE-0-2025-40124)
Vulnerability from cvelistv5
Published
2025-11-12 10:23
Modified
2026-08-05 12:07
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios enabled resulted from copy_from_user() returning impossibly large values greater than the size to be copied. This lead to __copy_from_iter() returning impossible values instead of the actual number of bytes it was able to copy. The BUG_ON has been reported in https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. The exception handlers expect that %o2 has already been masked during the bulk copy loop, but the masking was performed after that loop. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
References
Impacted products
Vendor Product Version
Linux Linux Version: ee841d0aff649164080e445e84885015958d8ff4
Version: ee841d0aff649164080e445e84885015958d8ff4
Version: ee841d0aff649164080e445e84885015958d8ff4
Version: ee841d0aff649164080e445e84885015958d8ff4
Version: ee841d0aff649164080e445e84885015958d8ff4
Version: ee841d0aff649164080e445e84885015958d8ff4
Version: ee841d0aff649164080e445e84885015958d8ff4
Version: ee841d0aff649164080e445e84885015958d8ff4
Version: 1c7e17b1c4d60cc5aa575460f7efb73686dd3b39
Version: ac663c54f40b2830b1ca32d1ae9d683fe248b14c
Version: 4.4.34   ≤
Version: 4.8.10   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/sparc/lib/U3memcpy.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fdd43fe6d286f27b826572457a89c926f97e2d3a",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "1198077606aeffb102587c6ea079ce99641c99d4",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "1857cdca12c4aff58bf26a7005a4d02850c29927",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "91eda032eb16e5d2be27c95584665bc555bb5a90",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "5ef9c94d7110e90260c06868cf1dcf899b9f25ee",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "e50377c6b3f278c9f3ef017ffce17f5fcc9dace4",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "lessThan": "47b49c06eb62504075f0f2e2227aee2e2c2a58b3",
              "status": "affected",
              "version": "ee841d0aff649164080e445e84885015958d8ff4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1c7e17b1c4d60cc5aa575460f7efb73686dd3b39",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac663c54f40b2830b1ca32d1ae9d683fe248b14c",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.34",
              "versionType": "semver"
            },
            {
              "lessThan": "4.9",
              "status": "affected",
              "version": "4.8.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/sparc/lib/U3memcpy.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.8.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III\n\nAnthony Yznaga tracked down that a BUG_ON in ext4 code with large folios\nenabled resulted from copy_from_user() returning impossibly large values\ngreater than the size to be copied. This lead to __copy_from_iter()\nreturning impossible values instead of the actual number of bytes it was\nable to copy.\n\nThe BUG_ON has been reported in\nhttps://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de\n\nThe referenced commit introduced exception handlers on user-space memory\nreferences in copy_from_user and copy_to_user. These handlers return from\nthe respective function and calculate the remaining bytes left to copy\nusing the current register contents. The exception handlers expect that\n%o2 has already been masked during the bulk copy loop, but the masking was\nperformed after that loop. This will fix the return value of copy_from_user\nand copy_to_user in the faulting case. The behaviour of memcpy stays\nunchanged."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The fault must occur inside a `copy_{from,to}_user()` on a buffer in the attacker\u0027s own address space, which requires local `mmap`/`munmap`/`mprotect` control plus a local syscall entry (write(2), ioctl(2), etc.). No remote peer can cause a user-copy fault at a chosen offset.\nAC:L - Every precondition is deterministic and attacker-chosen: length \u2265 192 selects the VIS block-copy path, dst/src alignment is controllable, and the fault offset is placed exactly by unmapping or PROT_NONE-ing a page of the source buffer. There is no race and no dependence on unpredictable memory layout.\nPR:L - Any unprivileged local user can trigger this with ordinary `write(2)`/`read(2)`/`ioctl(2)` plus `mmap`/`munmap`; no capability, namespace trick, or privileged device access is required.\nUI:N - The attacking process performs the entire sequence itself \u2014 mapping the partially-valid buffer and issuing the syscall. No victim action is involved.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The over-reported count underflows `iterate_iovec()`/`iterate_ubuf()` accounting, causing the iterator to walk past the end of the kernel iovec array and treat arbitrary kernel memory as iovec descriptors, and the resulting heap corruption primitive can be leveraged for kernel memory disclosure.\nI:H - `_inline_copy_from_user()`\u0027s tail `memset(to + (n - res), 0, res)` with `res \u003e n` wraps the pointer and zeroes up to ~n bytes of kernel heap memory *before* the destination buffer \u2014 an attacker-sized out-of-bounds write (4 KB underflow for a 4 KB copy) into adjacent slab objects, a well-known privilege-escalation primitive.\nA:H - The bug was reported as a hard `BUG_ON` panic in ext4\u0027s large-folio write path, and the `size_t` underflow of `iter-\u003ecount`/`len` also drives runaway iteration loops \u2014 both are full kernel denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:57.197Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fdd43fe6d286f27b826572457a89c926f97e2d3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1198077606aeffb102587c6ea079ce99641c99d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/1857cdca12c4aff58bf26a7005a4d02850c29927"
        },
        {
          "url": "https://git.kernel.org/stable/c/91eda032eb16e5d2be27c95584665bc555bb5a90"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ef9c94d7110e90260c06868cf1dcf899b9f25ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/e50377c6b3f278c9f3ef017ffce17f5fcc9dace4"
        },
        {
          "url": "https://git.kernel.org/stable/c/47b49c06eb62504075f0f2e2227aee2e2c2a58b3"
        }
      ],
      "title": "sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40124",
    "datePublished": "2025-11-12T10:23:19.861Z",
    "dateReserved": "2025-04-16T07:20:57.169Z",
    "dateUpdated": "2026-08-05T12:07:57.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.