---
id: CVE-2025-38261
title: 'riscv: save the SR_SUM status over switches'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  riscv: save the SR_SUM status over switches

  When threads/tasks are switched we need to ensure the old execution's
  SR_SUM state is saved and the new thread has the old …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 <
    c75dc906eef2a31c18318236f1047c6e0ef4e9dd
  - >-
    Linux >= 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 <
    1b63cdc0d63ae33522b4714642fbefa298acc274
  - >-
    Linux >= 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 <
    9e7005c3638134df5b7df467c1d884a2482c77cb
  - >-
    Linux >= 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 <
    69ea599a8dab93a620c92c255be4239a06290a77
  - >-
    Linux >= 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 <
    788aa64c01f1262310b4c1fb827a36df170d86ea
  - Linux 4.15
published: '2025-07-09'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:21:52.117Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38261'
references:
  - url: 'https://git.kernel.org/stable/c/c75dc906eef2a31c18318236f1047c6e0ef4e9dd'
  - url: 'https://git.kernel.org/stable/c/1b63cdc0d63ae33522b4714642fbefa298acc274'
  - url: 'https://git.kernel.org/stable/c/9e7005c3638134df5b7df467c1d884a2482c77cb'
  - url: 'https://git.kernel.org/stable/c/69ea599a8dab93a620c92c255be4239a06290a77'
  - url: 'https://git.kernel.org/stable/c/788aa64c01f1262310b4c1fb827a36df170d86ea'
tags:
  - cve.org
epss: 0.00237
epssPercentile: 0.14713
ingestedAt: '2026-10-21T12:48:53.705Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

riscv: save the SR_SUM status over switches

When threads/tasks are switched we need to ensure the old execution's
SR_SUM state is saved and the new thread has the old SR_SUM state
restored.

The issue was seen under heavy load especially with the syz-stress tool
running, with crashes as follows in schedule_tail:

Unable to handle kernel access to user memory without uaccess routines
at virtual address 000000002749f0d0
Oops [#1]
Modules linked in:
CPU: 1 PID: 4875 Comm: syz-executor.0 Not tainted
5.12.0-rc2-syzkaller-00467-g0d7588ab9ef9 #0
Hardware name: riscv-virtio,qemu (DT)
epc : schedule_tail+0x72/0xb2 kernel/sched/core.c:4264
 ra : task_pid_vnr include/linux/sched.h:1421 [inline]
 ra : schedule_tail+0x70/0xb2 kernel/sched/core.c:4264
epc : ffffffe00008c8b0 ra : ffffffe00008c8ae sp : ffffffe025d17ec0
 gp : ffffffe005d25378 tp : ffffffe00f0d0000 t0 : 0000000000000000
 t1 : 0000000000000001 t2 : 00000000000f4240 s0 : ffffffe025d17ee0
 s1 : 000000002749f0d0 a0 : 000000000000002a a1 : 0000000000000003
 a2 : 1ffffffc0cfac500 a3 : ffffffe0000c80cc a4 : 5ae9db91c19bbe00
 a5 : 0000000000000000 a6 : 0000000000f00000 a7 : ffffffe000082eba
 s2 : 0000000000040000 s3 : ffffffe00eef96c0 s4 : ffffffe022c77fe0
 s5 : 0000000000004000 s6 : ffffffe067d74e00 s7 : ffffffe067d74850
 s8 : ffffffe067d73e18 s9 : ffffffe067d74e00 s10: ffffffe00eef96e8
 s11: 000000ae6cdf8368 t3 : 5ae9db91c19bbe00 t4 : ffffffc4043cafb2
 t5 : ffffffc4043cafba t6 : 0000000000040000
status: 0000000000000120 badaddr: 000000002749f0d0 cause:
000000000000000f
Call Trace:
[<ffffffe00008c8b0>] schedule_tail+0x72/0xb2 kernel/sched/core.c:4264
[<ffffffe000005570>] ret_from_exception+0x0/0x14
Dumping ftrace buffer:
   (ftrace buffer empty)
---[ end trace b5f8f9231dc87dda ]---

The issue comes from the put_user() in schedule_tail
(kernel/sched/core.c) doing the following:

asmlinkage __visible void schedule_tail(struct task_struct *prev)
{
...
        if (current->set_child_tid)
                put_user(task_pid_vnr(current), current->set_child_tid);
...
}

the put_user() macro causes the code sequence to come out as follows:

1:	__enable_user_access()
2:	reg = task_pid_vnr(current);
3:	*current->set_child_tid = reg;
4:	__disable_user_access()

The problem is that we may have a sleeping function as argument which
could clear SR_SUM causing the panic above. This was fixed by
evaluating the argument of the put_user() macro outside the user-enabled
section in commit 285a76bb2cf5 ("riscv: evaluate put_user() arg before
enabling user access")"

In order for riscv to take advantage of unsafe_get/put_XXX() macros and
to avoid the same issue we had with put_user() and sleeping functions we
must ensure code flow can go through switch_to() from within a region of
code with SR_SUM enabled and come back with SR_SUM still enabled. This
patch addresses the problem allowing future work to enable full use of
unsafe_get/put_XXX() macros without needing to take a CSR bit flip cost
on every access. Make switch_to() save and restore SR_SUM.

## Affected

- `Linux >= 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 < c75dc906eef2a31c18318236f1047c6e0ef4e9dd`
- `Linux >= 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 < 1b63cdc0d63ae33522b4714642fbefa298acc274`
- `Linux >= 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 < 9e7005c3638134df5b7df467c1d884a2482c77cb`
- `Linux >= 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 < 69ea599a8dab93a620c92c255be4239a06290a77`
- `Linux >= 76d2a0493a17d4c8ecc781366850c3c4f8e1a446 < 788aa64c01f1262310b4c1fb827a36df170d86ea`
- `Linux 4.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.