Executive brief
A technical issue has been identified in the Linux kernel when compiled for MIPS-based systems using the LLVM compiler. Due to a compiler bug, the system may fail to correctly track internal memory addresses during startup, leading to an immediate system crash (kernel panic). This affects the availability of the system but does not directly expose data to remote attackers.
Technical details
The vulnerability is caused by an LLVM compiler bug (versions 18-21) affecting MIPS architectures. In the Linux kernel, the '__current_thread_info' pointer is stored in the global pointer ($gp) register. During kernel relocation, this register is updated to point to the new memory location. However, LLVM incorrectly restores the original $gp value in the function epilog of 'relocate_kernel()', even when it has been intentionally modified as a global register variable. This causes the kernel to reference invalid memory addresses in 'init_idle', resulting in a kernel paging request exception and subsequent crash. The fix involves using inline assembly to force the $gp assignment in a way that bypasses LLVM's incorrect restoration logic.
Affected products
- Linux Linux Kernel 6.19.0-rc5 and earlier versions compiled with LLVM 18-21 on MIPS architecture
Timeline
- 2026-02-05: other: Patch authored
- 2026-03-04: patched: Patch committed to stable tree
- 2026-06-03: advisory: CVE published
References
- https://git.kernel.org/stable/c/05bff9b0ae095b2420cfebb4a96759a09334bec6
- https://git.kernel.org/stable/c/1fe3b402b1e97a1718df3be0a1d3eee20133e735
- https://git.kernel.org/stable/c/30bfc2d6a1132a89a5f1c3b96c59cf3e4d076ea3
- https://git.kernel.org/stable/c/4dc65b40fb80c2020efbf139b9a38d30f9a37b92
- https://git.kernel.org/stable/c/561834f6d6f52b8a1791331e94b2aac753491d2a
- https://git.kernel.org/stable/c/9bc3b0ae5203aba650297fdf3e1e774125e423f2
- https://git.kernel.org/stable/c/c0155dee51b9f5f48aaf5c71cae005eb0e36521f