Critical Vulnerability in Linux Kernel: MIPS ABI Dereference Crash
Summary
CVE-2025-38696: In the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing system resources and hardware communication. It is widely used in various distributions, including Debian. This vulnerability affects the MIPS architecture of the Linux kernel, where certain tasks may not have an associated ABI or vDSO, leading to potential crashes when calling specific functions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where tasks without an associated ABI or vDSO can cause a crash. This occurs when such tasks call the stack_top() function, which attempts to dereference a NULL ABI pointer. The vulnerability can be exploited in scenarios involving kernel threads, particularly when using the kunit testing framework. The crash can lead to system instability and potential denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using kernel threads that may call stack_top() without a valid ABI or vDSO. Ensure that any testing frameworks, such as kunit, are configured correctly to prevent such calls.
Conclusion
The vulnerability in the Linux kernel related to MIPS ABI dereferencing poses a significant risk of system crashes. It is crucial to update to the latest patched versions of the Linux package to mitigate this risk. Users should also consider using tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes and instability, particularly affecting tasks that do not have an ABI or vDSO.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
The vulnerability affects all versions of the Linux package prior to the patched versions: 6.12.43-1 for Debian 13 and 6.16.3-1 for Debian 14.
Yes, updating to the patched versions of the Linux package is the permanent fix for this vulnerability.
If immediate updates are not possible, consider implementing workarounds by avoiding the use of kernel threads that may trigger the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
