CVE-2025-38434

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Revert "riscv: Define TASK_SIZE_MAX for __access_ok()"

This reverts commit ad5643cf2f69 ("riscv: Define TASK_SIZE_MAX for

__access_ok()").

This commit changes TASK_SIZE_MAX to be LONG_MAX to optimize access_ok(),

because the previous TASK_SIZE_MAX (default to TASK_SIZE) requires some

computation.

The reasoning was that all user addresses are less than LONG_MAX, and all

kernel addresses are greater than LONG_MAX. Therefore access_ok() can

filter kernel addresses.

Addresses between TASK_SIZE and LONG_MAX are not valid user addresses, but

access_ok() let them pass. That was thought to be okay, because they are

not valid addresses at hardware level.

Unfortunately, one case is missed: get_user_pages_fast() happily accepts

addresses between TASK_SIZE and LONG_MAX. futex(), for instance, uses

get_user_pages_fast(). This causes the problem reported by Robert [1].

Therefore, revert this commit. TASK_SIZE_MAX is changed t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References