CVE-2026-89489Medium· 5.5▾ SunlitA flaw was found in the Linux kernel. The `sys_or1k_atomic()` syscall, specific to the openrisc architecture, does not adequately validate user-provided pointers. An unprivileged process can exploit this by supplying kernel addresses to th…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
— → 7
none → high
— → 7
none → high
— → 7.8
none → high
7.8 → 7
7 → 7.8
Last analysed / modified upstream
7.8 → 5.5
high → medium
A flaw was found in the Linux kernel. The sys_or1k_atomic() syscall, specific to the openrisc architecture, does not adequately validate user-provided pointers. An unprivileged process can exploit this by supplying kernel addresses to the syscall, gaining unauthorized read and write access to kernel memory. This vulnerability allows an attacker to overwrite critical kernel data, potentially leading to arbitrary code execution with elevated privileges.
kernel: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-18.
Not affected:
Refer to the advisory for fix availability.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-80950Medium· 5.5kernel: i3c: renesas: Check that the transfer is valid before accessing it (CVE-2026-80950)
CVE-2026-80953Medium· 5.5kernel: i3c: master: adi: initialize the lock before enabling interrupts (CVE-2026-80953)
CVE-2026-80954Medium· 5.5kernel: i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() (CVE-2026-80954)
CVE-2026-80958Medium· 5.5kernel: dm-pcache: clamp the tail kset read to the segment data region (CVE-2026-80958)
CVE-2026-80959Medium· 5.5kernel: dm-pcache: bound the persisted tail-position offset (CVE-2026-80959)
CVE-2026-80975Medium· 5.5kernel: mfd: qnap-mcu: keep the reply buffer alive past a command timeout (CVE-2026-80975)