GHSA-5FWX-5J9V-M6CP

Vulnerability from github – Published: 2025-09-05 18:31 – Updated: 2025-11-03 18:31
VLAI?
Details

In the Linux kernel, the following vulnerability has been resolved:

MIPS: Don't crash in stack_top() for tasks without ABI or vDSO

Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash.

This can for example happen when using kunit:

mips_stack_top+0x28/0xc0
arch_pick_mmap_layout+0x190/0x220
kunit_vm_mmap_init+0xf8/0x138
__kunit_add_resource+0x40/0xa8
kunit_vm_mmap+0x88/0xd8
usercopy_test_init+0xb8/0x240
kunit_try_run_case+0x5c/0x1a8
kunit_generic_run_threadfn_adapter+0x28/0x50
kthread+0x118/0x240
ret_from_kernel_thread+0x14/0x1c

Only dereference the ABI point if it is set.

The GIC page is also included as it is specific to the vDSO. Also move the randomization adjustment into the same conditional.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-38696"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-04T16:15:38Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: Don\u0027t crash in stack_top() for tasks without ABI or vDSO\n\nNot all tasks have an ABI associated or vDSO mapped,\nfor example kthreads never do.\nIf such a task ever ends up calling stack_top(), it will derefence the\nNULL ABI pointer and crash.\n\nThis can for example happen when using kunit:\n\n    mips_stack_top+0x28/0xc0\n    arch_pick_mmap_layout+0x190/0x220\n    kunit_vm_mmap_init+0xf8/0x138\n    __kunit_add_resource+0x40/0xa8\n    kunit_vm_mmap+0x88/0xd8\n    usercopy_test_init+0xb8/0x240\n    kunit_try_run_case+0x5c/0x1a8\n    kunit_generic_run_threadfn_adapter+0x28/0x50\n    kthread+0x118/0x240\n    ret_from_kernel_thread+0x14/0x1c\n\nOnly dereference the ABI point if it is set.\n\nThe GIC page is also included as it is specific to the vDSO.\nAlso move the randomization adjustment into the same conditional.",
  "id": "GHSA-5fwx-5j9v-m6cp",
  "modified": "2025-11-03T18:31:37Z",
  "published": "2025-09-05T18:31:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38696"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/24d098b6f69b0aa806ffcb3e18259bee31650b28"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5b6839b572b503609b9b58bc6c04a816eefa0794"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/82d140f6aab5e89a9d3972697a0dbe1498752d9b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ab18e48a503230d675e824a0d68a108bdff42503"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bd90dbd196831f5c2620736dc221db2634cf1e8e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cddf47d20b0325dc8a4e57b833fe96e8f36c42a4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e78033e59444d257d095b73ce5d20625294f6ec2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e9f4a6b3421e936c3ee9d74710243897d74dbaa2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f22de2027b206ddfb8a075800bb5d0dacf2da4b8"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.