CVE-2025-38434

In the Linux kernel, the following vulnerability has been resolved: Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" This reverts commit ad5643cf2f69 ("riscv: Define TASK_SIZE_MAX for __access_ok()"). This commit changes TASK_SIZE_MAX to be LONG_MAX to optimize access_ok(), because the previous TASK_SIZE_MAX (default to TASK_SIZE) requires some computation. The reasoning was that all user addresses are less than LONG_MAX, and all kernel addresses are greater than LONG_MAX. Therefore access_ok() can filter kernel addresses. Addresses between TASK_SIZE and LONG_MAX are not valid user addresses, but access_ok() let them pass. That was thought to be okay, because they are not valid addresses at hardware level. Unfortunately, one case is missed: get_user_pages_fast() happily accepts addresses between TASK_SIZE and LONG_MAX. futex(), for instance, uses get_user_pages_fast(). This causes the problem reported by Robert [1]. Therefore, revert this commit. TASK_SIZE_MAX is changed to the default: TASK_SIZE. This unfortunately reduces performance, because TASK_SIZE is more expensive to compute compared to LONG_MAX. But correctness first, we can think about optimization later, if required.

• https://git.kernel.org/stable/c/890ba5be6335dbbbc99af14ea007befb5f83f174Patch
• https://git.kernel.org/stable/c/f8b1898748dfeb4f9b67b6a6d661f354b9de3523Patch
• https://git.kernel.org/stable/c/fe30c30bf3bb68d4a4d8c7c814769857b5c973e6Patch

Published

Jul 25, 2025

Last Modified

Jul 30, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-38429In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-3843A vulnerability was found in panhainan DS-Java 1.0. It has b…6.5
• CVE-2025-38430In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38431In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38432In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38433In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38435In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38436In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38437In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-38438In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38439In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-3844The PeproDev Ultimate Profile Solutions plugin for WordPress…9.8