A crafted signal frame can clear privileged supervisor register (SR) bits such as SPR_SR_DME during a user‑space return. The kernel previously copied the entire SR from the frame and only cleared the SM bit, leaving other privileged bits under the control of the unprivileged task. This flaw allows a non‑privileged process to disable data MMU protections and gain read/write access to arbitrary physical memory, constituting a local privilege escalation. The vulnerability also exposes additional privileged bits (IME, SUMRA, LEE, EPH, cache‑enable), widening potential impact.

All Linux kernel builds that include OpenRISC (openrisc) architecture support are affected. The exact kernel version range is not specified in the advisory; any kernel before the commit that restores privileged SR bits during signal return remains vulnerable.

The CVSS score is 7.8, indicating high severity, while the EPSS score is reported as < 1%, suggesting a relatively low likelihood of exploitation at present. The risk is still significant because the flaw enables local privilege escalation once an attacker gains the ability to craft a sigframe, which is a feasible local attack. The vulnerability is not listed in CISA’s KEV catalog. Exploitation is demonstrated by a PoC that clears SPR_SR_DME in rt_sigreturn and writes to an invalid physical address, causing a SIGSEGV when the patch is applied.