CVE-2026-80560 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
openrisc: signal: do not restore privileged SR bits on sigreturn
restore_sigcontext() copies the whole supervision register (SR) from the signal frame and only clears SPR_SR_SM before the value is reloaded into the hardware SR (through ESR and l.rfe) on the return to user space. All other SR bits are left under user control.
An unprivileged task can thus return from a signal handler through a crafted sigframe that clears SPR_SR_DME. With the data MMU disabled the CPU performs no translation or protection on data accesses, so the task gains read and write access to arbitrary physical memory, a local privilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH and the cache-enable bits are exposed the same way. The ptrace GPR regset already refuses any change to SR for exactly this reason.
Restore only the arithmetic flag bits (F, CY, OV) from the signal frame and take every privileged control bit from the SR the kernel saved on signal entry.
Verified with qemu-system-or1k -M or1k-sim: before this change an unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to physical address 0x03000000 (beyond the kernel's mem=32M); afterwards the same PoC receives SIGSEGV and physical memory is unchanged.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel for OpenRISC architecture contained a critical privilege escalation vulnerability within its signal handling mechanism, specifically in the restore_sigcontext function responsible for restoring processor state after a signal handler completes execution. This flaw stemmed from an overly permissive approach to restoring the Supervision Register (SR), which controls fundamental CPU operational modes including memory management and interrupt control. When returning from a signal context via rt_sigreturn, the kernel copied the entire SR value provided by the user-space application into the hardware register with only minimal filtering applied. Specifically, the code cleared only the Supervisor Mode bit to ensure the task returned to user mode but failed to mask out other privileged configuration bits that dictate how the CPU handles memory access and interrupts. This oversight allowed an unprivileged process to manipulate critical system control flags through a crafted signal frame, effectively bypassing kernel-enforced security boundaries.
The technical core of this vulnerability lies in the handling of the Data Memory Enable bit within the Supervision Register. By crafting a malicious sigframe that explicitly clears the SPR_SR_DME flag before restoration, an attacker could disable the data MMU for subsequent operations performed by their process. With the data MMU disabled, the CPU ceases to perform address translation or protection checks on memory accesses. Consequently, the compromised task gains unrestricted read and write access to arbitrary physical memory addresses. This capability allows the attacker to overwrite kernel structures, inject malicious code into privileged regions, or exfiltrate sensitive data from other processes that reside in physical memory space previously protected by virtual memory mappings. The vulnerability also exposes control over interrupt enablement bits such as SPR_SR_IME, supervisor mode register access SPR_SR_SUMRA, little-endian execution SPR_SR_LEE, external processor halt SPR_SR_EPH, and cache-enable bits, further expanding the potential attack surface for denial of service or state manipulation attacks.
The operational impact of this flaw is severe, constituting a local privilege escalation from unprivileged user space to kernel-level privileges. An attacker exploiting this vulnerability can achieve full control over the affected system by manipulating physical memory directly. This bypasses all standard Linux security mechanisms including SELinux, AppArmor, and namespace isolation, as these rely on proper virtual-to-physical address translation enforced by the MMU. The existence of this flaw was particularly notable because the ptrace GPR regset already correctly refused any changes to SR bits for similar reasons, indicating an inconsistency in how different interfaces handled privileged state restoration. This discrepancy highlighted a gap in defense-in-depth strategies where one interface provided protection while another did not, allowing attackers to bypass restrictions by choosing the signal return path instead of direct register manipulation via ptrace.
Mitigation and remediation involved modifying the restore_sigcontext function to strictly limit which bits are restored from user space. The fix ensures that only arithmetic flag bits such as F (Flag), CY (Carry), and OV (Overflow) are taken from the provided signal frame, while all privileged control bits are forcibly reset to values saved by the kernel during signal entry. This approach aligns with the principle of least privilege and prevents user-space applications from altering hardware configuration that affects system stability and security. The fix was verified using qemu-system-or1k simulations where a proof-of-concept attempt to clear SPR_SR_DME resulted in immediate segmentation faults rather than successful memory writes, confirming that physical memory protection is correctly enforced post-patch. This vulnerability maps to CWE-269 Improper Privilege Management as it involves an actor obtaining elevated privileges without proper authorization, and aligns with MITRE ATT&CK techniques related to privilege escalation via kernel exploitation or bypassing security-critical system calls.