https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 02:20:51 +0000 https://vulnerability.circl.lu/vuln/cve-2026-43073 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>x86-64: rename misleadingly named &#39;__copy_user_nocache()&#39; function</p> <p>This function was a masterclass in bad naming, for various historical reasons.</p> <p>It claimed to be a non-cached user copy. It is literally _neither_ of those things. It&#39;s a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses.</p> <p>Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86.</p> <p>The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal &#34;start user space access&#34; logic around it.</p> <p>But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully.</p> <p>Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak.</p> <p>Some of those random drivers then actively misused the user copying version (with ST…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>x86-64: rename misleadingly named &#39;__copy_user_nocache()&#39; function</p> <p>This function was a masterclass in bad naming, for various historical reasons.</p> <p>It claimed to be a non-cached user copy. It is literally _neither_ of those things. It&#39;s a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses.</p> <p>Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86.</p> <p>The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal &#34;start user space access&#34; logic around it.</p> <p>But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully.</p> <p>Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak.</p> <p>Some of those random drivers then actively misused the user copying version (with ST…</p> https://vulnerability.circl.lu/vuln/cve-2026-43073