Executive brief
The Linux kernel's MIPS scheduler code contains a critical memory management bug in the CPU affinity system (which controls which processors run specific tasks). When a configuration option is enabled, the code improperly copies user-provided data, corrupting memory and potentially allowing attackers to crash the system or execute code with kernel privileges. This affects MIPS-based systems including routers, network appliances, and embedded devices.
Technical details
The vulnerability is a buffer overflow / memory corruption issue in the mipsmt_sys_sched_setaffinity() system call (arch/mips/kernel/mips-mt-fpaff.c). When CONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer, but the original code uses sizeof(new_mask) which evaluates to pointer size instead of the actual mask buffer size. This causes copy_from_user() to write beyond the intended buffer, corrupting adjacent memory structures. Additionally, the original code performed copy_from_user() before allocating the mask buffer, causing a use-after-free scenario. The fix allocates the mask first, then uses cpumask_size() for proper bounds checking and copies data directly into the allocated buffer. No authentication is required; any user can trigger this via the sched_setaffinity syscall. A patch has been released and is available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel Multiple versions (MIPS architecture with CONFIG_CPUMASK_OFFSTACK enabled)
Timeline
- 2026-08-15: disclosed: CVE-2026-72181 published
- 2026-07-24: patched: Fix committed by Greg Kroah-Hartman to stable kernel trees
- 2026-05-26: other: Patch authored by Aaron Tomlin