Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80560— openrisc: signal: do not restore privileged SR bits on sigreturn

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： openrisc: signal: sigreturn 时不恢复特权 SR 位 会从信号帧中复制整个监督寄存器（SR），并仅在重新加载到硬件 SR（通过 ESR 和 指令返回用户空间时）之前清除 位，其余所有 SR 位均处于用户态控制之下。 因此，非特权任务可以通过精心构造的信号帧（sigframe），在信号处理函数返回时清除 位。当数据 MMU 被禁用时，CPU 对数据访问不再进行地址转换或保护，从而使该任务获得对任意物理内存的读写权限，导致本地提权。同样地， 、 、

CVSS 7.8 · High

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux ac689eb7f9d4e270d1365853b82eece669387e2c< bc2e24ba6e167ccf374a197457aa5640a802f429 affected
ac689eb7f9d4e270d1365853b82eece669387e2c< cf1b5514ddf9df098ce7e3741fc9679fd85a4ec6 affected
ac689eb7f9d4e270d1365853b82eece669387e2c< cd8b43a71755c516f5c1f265a103438ae9ab15be affected
ac689eb7f9d4e270d1365853b82eece669387e2c< b4d73c3848bae9084fa8b9b2aa76d99a7d8eb17d affected
ac689eb7f9d4e270d1365853b82eece669387e2c< 89a91b30685c0493b0fa2b47d0ab41061a63069d affected
ac689eb7f9d4e270d1365853b82eece669387e2c< a88d688be8d7f03cbf927f2ab454ea9fa58d2979 affected
ac689eb7f9d4e270d1365853b82eece669387e2c< 212fc482ddd7f9ccdd74a05eab1cac849350dcd6 affected
ac689eb7f9d4e270d1365853b82eece669387e2c< 32ef1b30ad736519f7a207bcc2986f3d4129d972 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80560

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
openrisc: signal: do not restore privileged SR bits on sigreturn
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: openrisc: signal: do not restore privileged SR bits on sigreturn restore_sigcontext() copies the whole supervision register (SR) from the signal frame and only clears SPR_SR_SM before the value is reloaded into the hardware SR (through ESR and l.rfe) on the return to user space. All other SR bits are left under user control. An unprivileged task can thus return from a signal handler through a crafted sigframe that clears SPR_SR_DME. With the data MMU disabled the CPU performs no translation or protection on data accesses, so the task gains read and write access to arbitrary physical memory, a local privilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH and the cache-enable bits are exposed the same way. The ptrace GPR regset already refuses any change to SR for exactly this reason. Restore only the arithmetic flag bits (F, CY, OV) from the signal frame and take every privileged control bit from the SR the kernel saved on signal entry. Verified with qemu-system-or1k -M or1k-sim: before this change an unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to physical address 0x03000000 (beyond the kernel's mem=32M); afterwards the same PoC receives SIGSEGV and physical memory is unchanged.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux ac689eb7f9d4e270d1365853b82eece669387e2c ~ bc2e24ba6e167ccf374a197457aa5640a802f429 -
Linux Linux 3.1 -

II. Public POCs for CVE-2026-80560

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80560

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80560 (7)

Other References for CVE-2026-80560 (1)

Same Patch Batch · Linux · 2026-08-26 · 92 CVEs total

CVE-2026-80589 9.8 CRITICAL block: stop the timeout timer when releasing a never added disk
CVE-2026-74752 9.8 CRITICAL sctp: validate cookie AUTH state before use
CVE-2026-80519 9.8 CRITICAL ovpn: finish crypto callback cleanup before peer release
CVE-2026-80528 9.8 CRITICAL ceph: avoid fs reclaim while using current->journal_info
CVE-2026-74746 9.8 CRITICAL netfilter: flowtable: publish GC-visible tuple last
CVE-2026-80561 9.8 CRITICAL libceph: fix multiple unsafe decodes in decode_locker()
CVE-2026-74744 9.8 CRITICAL ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
CVE-2026-74743 9.8 CRITICAL macvlan: inherit needed_headroom and needed_tailroom from lowerdev
CVE-2026-80558 9.8 CRITICAL libceph: Avoid using invalid osd indices from primary_temp
CVE-2026-80586 9.8 CRITICAL mptcp: options: reset DSS fields in case of unexpected size
CVE-2026-80557 9.8 CRITICAL libceph: fix OOB read in decode_watchers() via missing bounds check
CVE-2026-74737 9.8 CRITICAL net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
CVE-2026-80587 9.8 CRITICAL mptcp: avoid combining some incoming suboptions
CVE-2026-80585 9.4 CRITICAL mptcp: fastopen: only mark MPTFO subflows with SYN data
CVE-2026-74751 9.4 CRITICAL riscv: lib: Fix ZBB strnlen reading past count boundary
CVE-2026-80554 9.3 CRITICAL s390/vfio_ccw: Limit the number of channel program segments
CVE-2026-80551 9.3 CRITICAL s390/vfio_ccw: Ensure first IDAW remains constant
CVE-2026-80547 8.8 HIGH s390/vfio_ccw: Implement a crw lock
CVE-2026-80576 8.8 HIGH drm/amdgpu: reject oversized IBs with per-ring packet limits
CVE-2026-80552 8.8 HIGH s390/vfio_ccw: Ensure index for read/write regions are within range

Showing top 20 of 92 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80560

No comments yet

Leave a comment