A signed but unprivileged task can craft a signal frame that clears privileged Supervisor Register (SR) bits such as SPR_SR_DME during signal return. The kernel copies the entire SR from the frame and only clears the SM bit before reloading it, leaving other privileged bits under user control. An attacker can therefore gain read and write access to any physical memory address by disabling data MMU translations, which is a local privilege escalation. All other privileged SR bits (IME, SUMRA, LEE, EPH, cache‑enable) are exposed in the same way, expanding the potential impact. The fix restores only arithmetic flag bits from the frame and reloads all privileged bits from the kernel saved SR, preserving proper privilege boundaries.

All Linux kernel builds that include the OpenRISC architecture (openrisc) are affected. This includes any distribution kernel that has not yet incorporated the commit that restores privileged SR bits during signal return. The exact kernel version range is not specified, so any kernel older than the patch commit is vulnerable.

The CVSS score is not available in the current data, and the EPSS score is unknown, so the exposure likelihood cannot be quantified. The vulnerability is of high impact because it enables local privilege escalation on the OpenRISC platform. Attackers need only an unprivileged process capable of sending a signal and creating a custom sigframe, which is a feasible local attack vector. A public PoC demonstrates that an attacker can clear privileged SR bits and write to arbitrary physical memory, confirming exploitability. The vulnerability is not listed in CISA’s KEV catalog. However, the risk remains significant until the kernel is patched or the SR bits are properly restored as described in the introduced commit.