# CVE-2026-80560: openrisc: signal: do not restore privileged SR bits on sigreturn

> An unprivileged user can escalate privileges by crafting a signal frame to disable MMU protection, allowing arbitrary physical memory access.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 26 Aug 2026
- **Updated:** 27 Aug 2026
- **Also known as:** AZL-97788, BELL-CVE-2026-80560, DEBIAN-CVE-2026-80560, GHSA-gfrq-95rp-6g53, UBUNTU-CVE-2026-80560

## What is CVE-2026-80560?

CVE-2026-80560 is a high-severity vulnerability in Linux, published on 26 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

openrisc: signal: do not restore privileged SR bits on sigreturn

restore_sigcontext() copies the whole supervision register (SR) from the
signal frame and only clears SPR_SR_SM before the value is reloaded into
the hardware SR (through ESR and l.rfe) on the return to user space.  All
other SR bits are left under user control.

An unprivileged task can thus return from a signal handler through a
crafted sigframe that clears SPR_SR_DME.  With the data MMU disabled the
CPU performs no translation or protection on data accesses, so the task
gains read and write access to arbitrary physical memory, a local
privilege escalation.  SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH
and the cache-enable bits are exposed the same way.  The ptrace GPR regset
already refuses any change to SR for exactly this reason.

Restore only the arithmetic flag bits (F, CY, OV) from the signal frame
and take every privileged control bit from the SR the kernel saved on
signal entry.

Verified with qemu-system-or1k -M or1k-sim: before this change an
unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to
physical address 0x03000000 (beyond the kernel's mem=32M); afterwards the
same PoC receives SIGSEGV and physical memory is unchanged.

## Which versions are affected by CVE-2026-80560?


## How do I fix CVE-2026-80560?

Apply the vendor's patch.

## Is CVE-2026-80560 being exploited?

There is no known exploitation of CVE-2026-80560 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-80560 and fix it if it is affected.

What it is: CVE-2026-80560 is a high-severity vulnerability in Linux, published on 26 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-80560 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-80560/ (Markdown: https://insights.sbomify.com/CVE-2026-80560/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-80560
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-80560
- OSV: https://osv.dev/vulnerability/CVE-2026-80560

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-80560/
Summaries are generated and may contain mistakes; the official description above is the record.