Skip to content
Heist/ feed
Back to feed
UnratedFix available

x86-64: rename misleadingly named '__copy_user_nocache()' function

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: x86-64: rename misleadingly named '__copy_user_nocache()' function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It's a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses. Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal "start user space access" logic around it. But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak. Some of those random drivers then actively misused the user copying version (with STAC/CLAC and a

Products
Kernel
Affected versions
Not specified
Fixed versions
6.12.83, 6.18.24, 6.19.14, 6.6.160, 7.0.1
CVEs
CVE-2026-43073
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 19:22 UTC · Revision 1

Source evidence

x86-64: rename misleadingly named '__copy_user_nocache()' function

core-osv · Original source

Published 5 May 2026, 15:29 UTC

In the Linux kernel, the following vulnerability has been resolved: x86-64: rename misleadingly named '__copy_user_nocache()' function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It's a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses. Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal "start user space access" logic around it. But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak. Some of those random drivers then actively misused the user copying version (with STAC/CLAC and a

osv:CVE-2026-43073

Kernel

Fixed versions: 6.6.160, 6.12.83, 6.18.24, 6.19.14, 7.0.1

Complete source record
{
  "id": "d8cb3f2ca05bd5e206c06f8c27c17a0abb260c19ce9d5a88d9ea14e259b07d8f",
  "url": "https://osv.dev/vulnerability/CVE-2026-43073",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "x86-64: rename misleadingly named '__copy_user_nocache()' function",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: x86-64: rename misleadingly named '__copy_user_nocache()' function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It's a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses. Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal \"start user space access\" logic around it. But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak. Some of those random drivers then actively misused the user copying version (with STAC/CLAC and a",
    "evidence": "osv:CVE-2026-43073",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.6.160",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.83",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.24",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.19.14",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.0.1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-43073",
      "aliases": [
        "CVE-2026-43073"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "06917f753547e6bba8a5d17f79971d1c071a70dd"
                },
                {
                  "fixed": "73c2dc2c14d6a2efa5dde469546a907482af07fe"
                },
                {
                  "fixed": "14b9194db4a28421a4dbe5d6e519efbaa7c5f3cd"
                },
                {
                  "fixed": "c6d4e0599e7e73abc04e2488dfeb7940c4039660"
                },
                {
                  "fixed": "d993e1723aa2a085aa0d72e70ea889031fc225b4"
                },
                {
                  "fixed": "efea91ad1729ff1853d7418e4d3bc27d085e72d0"
                },
                {
                  "fixed": "d187a86de793f84766ea40b9ade7ac60aabbb4fe"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43073.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.2.0"
                },
                {
                  "fixed": "6.6.160"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.83"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.24"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "6.19.14"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.20.0"
                },
                {
                  "fixed": "7.0.1"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43073.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:31.508699587Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/14b9194db4a28421a4dbe5d6e519efbaa7c5f3cd",
        "https://git.kernel.org/stable/c/73c2dc2c14d6a2efa5dde469546a907482af07fe",
        "https://git.kernel.org/stable/c/c6d4e0599e7e73abc04e2488dfeb7940c4039660",
        "https://git.kernel.org/stable/c/d187a86de793f84766ea40b9ade7ac60aabbb4fe",
        "https://git.kernel.org/stable/c/d993e1723aa2a085aa0d72e70ea889031fc225b4",
        "https://git.kernel.org/stable/c/efea91ad1729ff1853d7418e4d3bc27d085e72d0",
        "https://project-zero.issues.chromium.org/issues/496923375",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43073.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-43073",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43073.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-43073",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 498677,
  "published_at": "2026-05-05T15:29:29.51+00:00"
}