CVE-2026-89489— openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： openrisc：修复通过 or1k_atomic 系统调用导致的任意内核内存访问问题 （在 "or1k" ABI 中对应系统调用号 244）接收两个用户空间指针 和 ，并通过手写汇编代码交换它们所指向的字（word）。 l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 这两个指针未经过 进行有效性检查。上述四次内存访问也没有对应的异常处理表（exception table）条目。 调用方若将某个
Affected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 9d02a4283e9ce4e9ca11ff00615bdacdb0515a1a< a520e8cac54fb403f3800125b606f55fcad42cb9 |
affected |
9d02a4283e9ce4e9ca11ff00615bdacdb0515a1a< d64a75369cd0f2ee79afcc9d9ca34a3890989379 |
affected | ||
9d02a4283e9ce4e9ca11ff00615bdacdb0515a1a< b53435c079c78f89f70a62dd5a322cca4e292b34 |
affected | ||
9d02a4283e9ce4e9ca11ff00615bdacdb0515a1a< 78004e9a87f240df03e2f73120d291763c32e0a7 |
affected | ||
3.1 |
affected | ||
< 3.1 |
unaffected | ||
6.12.109≤ 6.12.* |
unaffected | ||
6.18.50≤ 6.18.* |
unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89489
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.
l.lwz r29,0(r4)
l.lwz r27,0(r5)
l.sw 0(r4),r27
l.sw 0(r5),r29
The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.
A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.
This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.
Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.
[shorne@gmail.com: fix comment style]
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-89489
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89489
请登录查看更多情报信息。
Other References for CVE-2026-89489 (4)
Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total
| CVE-2026-89490 | ocfs2: fix readdir position truncation on 32-bit kernels | |
| CVE-2026-89477 | sctp: fix NULL deref on untransmitted RECONF completion | |
| CVE-2026-89478 | sctp: drop a chunk if its transport was removed | |
| CVE-2026-89479 | sctp: stop processing a packet once its association is deleted | |
| CVE-2026-89480 | nvme-tcp: reject a read that transferred too few bytes | |
| CVE-2026-89482 | nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone | |
| CVE-2026-89481 | nvme-tcp: fix host memory disclosure on R2T for a read command | |
| CVE-2026-89483 | nvme: zero the discard fallback page | |
| CVE-2026-89484 | lockd: fix NULL dereference on lockowner allocation failure | |
| CVE-2026-89485 | lockd: pin next file across nlm_inspect_file lock-drop | |
| CVE-2026-89486 | ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() | |
| CVE-2026-89487 | openvswitch: only skb_tx_error() a packet we are about to drop | |
| CVE-2026-89488 | openvswitch: Fix CT limit teardown use-after-free | |
| CVE-2026-89491 | ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() | |
| CVE-2026-89501 | ring-buffer: Hold cpu_buffer::lock when resizing a subbuf | |
| CVE-2026-89498 | orangefs: fix double-free of trailer_buf on readdir copy failure | |
| CVE-2026-89499 | ring-buffer: Stop remote reader update when page swap fails | |
| CVE-2026-89500 | ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page | |
| CVE-2026-89497 | orangefs: skip leading spaces before parsing client debug masks | |
| CVE-2026-89502 | ring-buffer: Free cpu_buffer::free_page with subbuf_order |
Showing top 20 of 431 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-89773
drm/amd/display: Skip Update HDCP Config In Transition State -
CVE-2026-89772
btrfs: write-protect folios during data writeback -
CVE-2026-89771
ring-buffer: Fix subbuf resize race with ring buffer readers -
CVE-2026-89770
iomap: don't free integrity payload that doesn't exist -
CVE-2026-89769
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_sta
Same vendor: Linux
-
CVE-2026-89773
drm/amd/display: Skip Update HDCP Config In Transition State -
CVE-2026-89772
btrfs: write-protect folios during data writeback -
CVE-2026-89771
ring-buffer: Fix subbuf resize race with ring buffer readers -
CVE-2026-89770
iomap: don't free integrity payload that doesn't exist -
CVE-2026-89769
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_sta
V. Comments for CVE-2026-89489
No comments yet