Executive brief
A vulnerability in the Linux kernel's MIPS architecture support could cause a system crash during the boot process. On certain 64-bit systems, the kernel may attempt to pass memory addresses to older 32-bit hardware components that cannot understand them, leading to a kernel panic. This primarily affects the reliability and availability of the system during startup or when specific console drivers are used.
Technical details
In 64-bit MIPS configurations for DECstations, the initial console output handler (prom_console_write) may be called from a kernel thread where the stack is located in the XKPHYS 64-bit memory segment. When the handler passes a buffer address from this stack to the 32-bit firmware's printf() entry point, the address is truncated. This results in the firmware attempting to access invalid memory locations, causing a kernel panic (ExcCode 02, BadVA). The fix involves moving the console buffer from the stack to a static __initdata buffer located in the CKSEG0 32-bit compatibility segment. This ensures the address remains valid after truncation by the firmware.
Affected products
- Linux Linux Kernel v2.6.12+
Timeline
- 2026-05-06: other: Patch authored
- 2026-07-04: patched: Patch committed to stable tree
- 2026-07-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/07c245bc39f94481fd75ff1ed54f7ab97111f3dd
- https://git.kernel.org/stable/c/1c80327dedf05b8c8ca025b76c21235b19dd3a86
- https://git.kernel.org/stable/c/35212f2adc2cf15122b96b987519de235b855e46
- https://git.kernel.org/stable/c/6e61fc2e06e44b6d30248cc5bc47a58e75c2b43e
- https://git.kernel.org/stable/c/7fb13fd35110ebe95eb053faf79d018f51144d85
- https://git.kernel.org/stable/c/8a15826e5d3bdcfbef2f8e9330c69ea9ee7282e7
- https://git.kernel.org/stable/c/9e22b6fc6532cd566dad6d89d8fb3885248e364a