Executive brief
A vulnerability in the Linux kernel's MIPS architecture support can cause memory corruption during the system boot process. This occurs when the kernel's function tracing tool (ftrace) attempts to handle memory addresses larger than 32 bits, leading to a buffer overflow. In practice, this can result in system instability, data corruption, or a complete system hang (denial of service) shortly after startup.
Technical details
An out-of-bounds write (CWE-787) exists in arch/mips/kernel/ftrace.c due to an incorrect assumption about instruction length. The ftrace implementation allocates an int[2] array to store generated instructions, but the UASM_i_LA macro can generate more than two instructions when the _mcount address exceeds 32 bits. This results in a buffer overflow that corrupts adjacent variables in the __read_mostly section, such as __cpu_primary_thread_mask. The vulnerability is triggered locally during boot or when dynamic ftrace is initialized. Patches have been released for various stable branches including 6.12.64 and 6.18.3.
Affected products
- Linux Linux Kernel 2.6.35 to 6.12.63, 6.13 to 6.18.2
Timeline
- 2025-11-28: disclosed: Initial patch authored
- 2026-01-02: patched: Patch committed to stable tree
- 2026-01-14: advisory: CVE-2025-71109 published