SB20261023145 - Untrusted Pointer Dereference in Linux kernel include asm

Description

This security bulletin contains information about 1 vulnerability.

1) Untrusted Pointer Dereference (CVE-ID: CVE-2026-99016)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read and modify arbitrary kernel memory, potentially causing a denial of service.

The vulnerability exists due to untrusted pointer dereference in the RISC-V arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic() helpers when processing tagged user pointers with the tagged-address ABI enabled. A local user can supply a crafted tagged pointer to FUTEX_WAKE_OP that passes validation after tag removal but retains its tag during the atomic access, causing an atomic read-modify-write on a kernel address and using the comparison result as a read oracle to disclose kernel memory contents.

The described overlap between tag bits and canonical-address bits occurs with Sv57 and PMLEN=16.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2e5c80bbc062a8dda33e687ebf7be8f074ee4f7d
• https://git.kernel.org/stable/c/405290be962b32eec842776fbe3bdf81f15b1676
• https://git.kernel.org/stable/c/8e48d8d51ab37b7decfbff3e2844e027a52ad6ea