The Linux kernel's or1k_atomic syscall (syscall 244 in the openrisc ABI) takes two user-space pointers and swaps the words they point to using hand-written assembly instructions. The pointers were not checked with access_ok(), and the memory accesses lacked exception table entries. This allowed an unprivileged process to pass kernel addresses as pointers, resulting in arbitrary kernel memory read/write primitives. Exploiting this could overwrite kernel data like the sys_call_table, enabling kernel code execution. The vulnerability was fixed by adding pointer validation before the critical section and adding fixups for the memory accesses to handle faults on valid but unmapped user addresses by returning -EFAULT.

An unprivileged local attacker could exploit this vulnerability to gain arbitrary read and write access to kernel memory. This could lead to overwriting critical kernel data structures such as the sys_call_table, resulting in arbitrary code execution within the kernel context. This elevates the attacker's privileges to kernel level, compromising the entire system's security.

A fix is available that validates user pointers before performing memory operations and adds fault handling for invalid user addresses. Systems should apply the official kernel patch that addresses this vulnerability. No additional mitigation steps are indicated beyond applying the fix.