The Linux kernel contains a system call sys_or1k_atomic that performs a word swap between two memory addresses supplied by the caller. The implementation performs four raw memory accesses—two reads and two writes—without validating the supplied pointers. Consequently, an unprivileged user on OpenRISC platforms can provide a kernel address as either pointer and cause the kernel to read from or write to that address. This arbitrary kernel memory read/write capability enables an attacker to overwrite critical kernel structures such as the sys_call_table, effectively granting arbitrary kernel‑level code execution. The flaw is a classic example of unchecked user‑supplied pointers, categorized as CWE‑822.

The affected product is the Linux kernel running on OpenRISC architecture. Any release of the Linux kernel that compiles with the or1k ABI and does not include the patch is vulnerable. No specific version numbers are listed, so any release of the Linux kernel that exposes this syscall on OpenRISC is considered vulnerable.

With a CVSS score of 7.0 this vulnerability has a high impact. The EPSS score is less than 1%, indicating a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. It provides an unprivileged local user with a kernel read/write primitive that can be used to overwrite critical kernel data structures such as the sys_call_table, leading to kernel‑level code execution. Based on the description, the exploit requires a local unprivileged user to invoke the syscall with a kernel address, which is unlikely without administrative access.