Executive brief
The Linux kernel contains a vulnerability in MIPS BMIPS architecture support for Broadcom BCM6358 devices that causes kernel panics when USB devices are initialized. The issue occurs due to improper Read-Ahead Cache (RAC) initialization by the bootloader, leading to system crashes and service unavailability on affected embedded devices.
Technical details
This is a kernel panic vulnerability in the MIPS BMIPS architecture layer affecting Broadcom BCM6358 SoCs. The root cause is that the bootloader (CFE) fails to properly initialize the Read-Ahead Cache on the second thread (TP1). When the kernel attempts to flush the uninitialized RAC, it corrupts the instruction stream, triggering a "Reserved instruction" exception and fatal kernel panic. The vulnerability manifests when EHCI/OHCI USB controllers are initialized during boot from TP1. The fix involves disabling RAC flush operations for TP1 to prevent cache corruption. The attack vector is local and non-network; the vulnerability impacts system availability by causing guaranteed kernel panics on affected hardware configurations during normal USB device enumeration.
Affected products
- Linux Linux kernel affected versions include 5.10.16 and likely others
Timeline
- 2025-12-24: disclosed