Executive brief
A flaw in the Linux kernel's MIPS DEC architecture code can cause the system to hang during bootstrap when firmware console output functions are called from kernel threads in 64-bit configurations. The issue occurs because the stack pointer is placed in a 64-bit memory segment, causing 32-bit firmware code to calculate incorrect stack values and lose control flow, potentially preventing the system from completing startup.
Technical details
This is a stack corruption vulnerability in the MIPS DEC firmware interface layer. The root cause is that the o32 (32-bit ABI) prom_printf() firmware entry point expects a 32-bit stack pointer, but in 64-bit kernel configurations running on non-initial kernel threads, the stack is allocated in the XKPHYS 64-bit memory segment. When the 32-bit firmware code performs ALU operations on this 64-bit pointer value, the result is unpredictable and incorrect, causing execution to go astray. The attack vector is local only (triggered during kernel bootstrap via console output), with no authentication or user interaction required. The fix arranges for prom_printf() to use a stack buffer from the CKSEG0 32-bit compatibility segment via a modified call_o32() wrapper, ensuring the stack pointer remains 32-bit compatible during firmware calls.
Affected products
- Linux Linux kernel MIPS DEC 64-bit configurations
Timeline
- 2026-08-15: disclosed