In the Linux kernel, the following vulnerability has been resolved:
parisc: Revise __get_user() to probe user read access
Because of the way read access support is implemented, read access
interruptions are only triggered at privilege levels 2 and 3. The
kernel executes at privilege level 0, so __get_user() never triggers
a read access interruption (code 26). Thus, it is currently possible
for user code to access a read protected address via a system call.
Fix this by probing read access rights at privilege level 3 (PRIV_USER)
and setting __gu_err to -EFAULT (-14) if access isn't allowed.
Note the cmpiclr instruction does a 32-bit compare because COND macro
doesn't work inside asm.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
07 Jan 2026, 19:41
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| First Time |
Linux
Debian Debian debian Linux Linux linux Kernel |
|
| CPE | cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () https://git.kernel.org/stable/c/28a9b71671fb4a2993ef85b8ef6f117ea63894fe - Patch | |
| References | () https://git.kernel.org/stable/c/4c981077255acc2ed5b3df6e8dd0125c81b626a9 - Patch | |
| References | () https://git.kernel.org/stable/c/741b163e440683195b8fd4fc8495fcd0105c6ab7 - Patch | |
| References | () https://git.kernel.org/stable/c/89f686a0fb6e473a876a9a60a13aec67a62b9a7e - Patch | |
| References | () https://git.kernel.org/stable/c/f410ef9a032caf98117256b22139c31342d7bb06 - Patch | |
| References | () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory |
03 Nov 2025, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
05 Sep 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-05 18:15
Updated : 2026-01-07 19:41
NVD link : CVE-2025-39716
Mitre link : CVE-2025-39716
CVE.ORG link : CVE-2025-39716
JSON object : View
Products Affected
debian
- debian_linux
linux
- linux_kernel
CWE