CVE-2025-40124 sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
A flaw in SPARC copy_from_user exception handling causes incorrect byte counts, leading to kernel BUG_ON crashes and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40124?
CVE-2025-40124 is a high-severity memory corruption vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios enabled resulted from copy_from_user() returning impossibly large values greater than the size to be copied. This lead to __copy_from_iter() returning impossible values instead of the actual number of bytes it was able to copy.
The BUG_ON has been reported in https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. The exception handlers expect that %o2 has already been masked during the bulk copy loop, but the masking was performed after that loop. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
Which versions are affected by CVE-2025-40124?
How do I fix CVE-2025-40124?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-40124 being exploited?
There is no known exploitation of CVE-2025-40124 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40124, DEBIAN-CVE-2025-40124, GHSA-v3c5-2xf8-7jwx, ROOT-OS-DEBIAN-11-CVE-2025-40124, ROOT-OS-DEBIAN-13-CVE-2025-40124, ROOT-OS-UBUNTU-2404-CVE-2025-40124 and 1 more.