CVE-2026-80560

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The flaw is only reachable through the local rt_sigreturn syscall path (userspace trap to _sys_call_handler, sys_rt_sigreturn, restore_sigcontext, then l.rfe); OpenRISC signal handling has no network, adjacent-wireless, or physical-device entry point.

AC:LAttack complexity, low

Exploitation is deterministic because the attacker fully controls the rt_sigframe SR field and can invoke rt_sigreturn directly; the fix author verified an unprivileged PoC on qemu-system-or1k that clears SPR_SR_DME and writes arbitrary physical memory.

PR:LPrivileges required, low

Any unprivileged local process can call rt_sigreturn with a crafted sigframe on its own stack; the path performs only access_ok/copy_from_user checks and has no capability, authentication, or init-namespace root requirement.

UI:NUser interaction, none

No separate victim interaction is needed; the attacker can self-send a signal or directly syscall rt_sigreturn with a forged stack frame in their own process without requiring another user to mount, plug in, or approve anything.

S:UScope, unchanged

This is standard host-kernel privilege escalation by restoring attacker-controlled CPU privilege bits on sigreturn; it does not cross a VM guest/host, container sandbox, or IOMMU security boundary despite granting direct physical memory access.

C:HConfidentiality impact, high

Clearing SPR_SR_DME disables data MMU translation and protection, allowing an unprivileged task to read arbitrary physical addresses including kernel memory; other exposed SR bits (SPR_SR_IME, SPR_SR_SUMRA, cache enables) further broaden privileged-state disclosure.

I:HIntegrity impact, high

With SPR_SR_DME cleared the CPU performs unprotected physical data accesses, giving arbitrary read/write to all of RAM; the fix commit PoC writes a marker beyond the kernel mem=32M reservation, demonstrating direct integrity compromise and local root escalation.

A:HAvailability impact, high

Arbitrary physical memory writes can corrupt kernel text, data, or device MMIO and trigger oops or panic; manipulating privileged SR and cache-control bits can also destabilize the system even when full exploitation is not attempted.