Linux kernel: Improper pointer untagging in RISC-V futex helpers
Summary
In the Linux kernel's RISC-V port, the futex helpers check the untagged user address but perform the atomic operation on the still-tagged raw pointer when the tagged address ABI is enabled. A local, low-privileged user can use FUTEX_WAKE_OP to perform atomic read-modify-write operations on arbitrary kernel addresses, with the comparison result acting as a read oracle. This can lead to privilege escalation and information disclosure; the impact is limited to systems running RISC-V with CONFIG_RISCV_ISA_SUPM and a non-zero PMLEN.
Affected
- Linux kernel, RISC-V architecture, with CONFIG_RISCV_ISA_SUPM enabled and the tagged address ABI in use (PMLEN != 0)
- Affected range per CNA record: from commit 2e1743085887ba3f553c2bb472a75a3ff744b242 up to the fixing commits; the CNA lists 6.13 as affected and 6.18.57 and 7.2.11 as unaffected branches
- Exact affected versions for distribution kernels: Unknown.
Fixed in
- Upstream fixes: commits 2e5c80bbc062a8dda33e687ebf7be8f074ee4f7d, 405290be962b32eec842776fbe3bdf81f15b1676, 8e48d8d51ab37b7decfbff3e2844e027a52ad6ea
- Stable branches: 6.18.57 and 7.2.11 (per OSV)
- Distribution packages with the fix: Unknown.
Workaround
Unknown. Disabling the tagged address ABI may reduce exposure, but no source confirms this.
Exploitation
- No evidence found of in-the-wild exploitation.
- Not listed in the CISA KEV catalogue (as far as found).
- No public proof of concept found.
- Status: unknown.
Our recommendation
- Check whether any systems run RISC-V hardware or kernels with CONFIG_RISCV_ISA_SUPM.
- For RISC-V systems, apply kernel updates as soon as distributor packages with the fix are available.
- For other architectures (x86-64, ARM), no action beyond normal kernel patching is required.
- Restrict local shell access on multi-user hosts to reduce the risk of a local foothold.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Kernel stable commit 2e5c80bb git.kernel.org
- Kernel stable commit 405290be git.kernel.org
- Kernel stable commit 8e48d8d5 git.kernel.org
- NVD record via Vulners vulners.com
- OSV record via Vulners vulners.com
- Ubuntu security notice ubuntu.com
- SUSE CVE record via Vulners vulners.com
- Bell Software Alpaquita OSV entry osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:27.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic() hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc.w through the "+m" (*uaddr) operand. When the tagged address ABI is enabled (CONFIG_RISCV_ISA_SUPM, prctl PR_SET_TAGGED_ADDR_CTRL with PMLEN != 0), those two addresses differ: a user pointer whose top PMLEN bits hold a tag passes access_ok() after untagging, but the atomic is then performed on the still-tagged raw address. Supervisor-mode data accesses are not subject to the U-mode pointer masking (that is governed by menvcfg.PMM, which the kernel does not set), so hardware does not strip the tag for the kernel's own access. With Sv57 and PMLEN=16 the tag bits overlap the canonical-address bits, so a tagged pointer can name a canonical kernel virtual address (e.g. in the linear map) whose untagged form is a valid user address. An unprivileged process can thus make FUTEX_WAKE_OP perform an atomic read-modify-write on an arbitrary kernel address, with the matching FUTEX_OP_CMP_* result serving as a read oracle. get_user()/put_user()/raw_copy_{to,from}_user() already untag the pointer after the access_ok() check; do the same in the futex helpers so the atomic operates on the address that was actually validated.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.