In the Linux kernel, the following vulnerability has been resolved:
MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash.
This can for example happen when using kunit:
mips_stack_top+0x28/0xc0
arch_pick_mmap_layout+0x190/0x220
kunit_vm_mmap_init+0xf8/0x138
__kunit_add_resource+0x40/0xa8
kunit_vm_mmap+0x88/0xd8
usercopy_test_init+0xb8/0x240
kunit_try_run_case+0x5c/0x1a8
kunit_generic_run_threadfn_adapter+0x28/0x50
kthread+0x118/0x240
ret_from_kernel_thread+0x14/0x1c
Only dereference the ABI point if it is set.
The GIC page is also included as it is specific to the vDSO. Also move the randomization adjustment into the same conditional.
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9f4a6b3421e936c3ee9d74710243897d74dbaa2",
"id": "CVE-2025-38696-0d57962b",
"digest": {
"function_hash": "339117677172509833881536753378752996540",
"length": 402.0
},
"target": {
"function": "mips_stack_top",
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cddf47d20b0325dc8a4e57b833fe96e8f36c42a4",
"id": "CVE-2025-38696-0f9fd7aa",
"digest": {
"line_hashes": [
"174531921704201773795594372300676260859",
"312661315948785305438634058546425896414",
"221860581993300452013222647744979991015",
"314473233638618434166516308080223199291",
"177095723285263561356689525325976337257",
"239265073563348170559306858305789065704",
"121384373516309451930289772580360023244",
"118022838513293996521388288842022556882",
"221778099946814380693429125042175906728",
"311807471554538287499496573203833481378"
],
"threshold": 0.9
},
"target": {
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab18e48a503230d675e824a0d68a108bdff42503",
"id": "CVE-2025-38696-1427dc8e",
"digest": {
"line_hashes": [
"96275216832108555262107342612930982931",
"237594617766621672097384813597610653924",
"47105041552153016661286047300059141988",
"314473233638618434166516308080223199291",
"177095723285263561356689525325976337257",
"239265073563348170559306858305789065704",
"121384373516309451930289772580360023244",
"118022838513293996521388288842022556882",
"221778099946814380693429125042175906728",
"311807471554538287499496573203833481378"
],
"threshold": 0.9
},
"target": {
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b6839b572b503609b9b58bc6c04a816eefa0794",
"id": "CVE-2025-38696-26edbac8",
"digest": {
"line_hashes": [
"174531921704201773795594372300676260859",
"312661315948785305438634058546425896414",
"221860581993300452013222647744979991015",
"314473233638618434166516308080223199291",
"177095723285263561356689525325976337257",
"239265073563348170559306858305789065704",
"121384373516309451930289772580360023244",
"118022838513293996521388288842022556882",
"221778099946814380693429125042175906728",
"311807471554538287499496573203833481378"
],
"threshold": 0.9
},
"target": {
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab18e48a503230d675e824a0d68a108bdff42503",
"id": "CVE-2025-38696-33b87ddb",
"digest": {
"function_hash": "35150594806145260542411592986121371488",
"length": 355.0
},
"target": {
"function": "mips_stack_top",
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cddf47d20b0325dc8a4e57b833fe96e8f36c42a4",
"id": "CVE-2025-38696-40eaae66",
"digest": {
"function_hash": "339117677172509833881536753378752996540",
"length": 402.0
},
"target": {
"function": "mips_stack_top",
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f22de2027b206ddfb8a075800bb5d0dacf2da4b8",
"id": "CVE-2025-38696-46b76204",
"digest": {
"function_hash": "339117677172509833881536753378752996540",
"length": 402.0
},
"target": {
"function": "mips_stack_top",
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24d098b6f69b0aa806ffcb3e18259bee31650b28",
"id": "CVE-2025-38696-50935ce1",
"digest": {
"function_hash": "339117677172509833881536753378752996540",
"length": 402.0
},
"target": {
"function": "mips_stack_top",
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd90dbd196831f5c2620736dc221db2634cf1e8e",
"id": "CVE-2025-38696-5db20c53",
"digest": {
"function_hash": "339117677172509833881536753378752996540",
"length": 402.0
},
"target": {
"function": "mips_stack_top",
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82d140f6aab5e89a9d3972697a0dbe1498752d9b",
"id": "CVE-2025-38696-6ebaa9ee",
"digest": {
"function_hash": "339117677172509833881536753378752996540",
"length": 402.0
},
"target": {
"function": "mips_stack_top",
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82d140f6aab5e89a9d3972697a0dbe1498752d9b",
"id": "CVE-2025-38696-7a3a8c25",
"digest": {
"line_hashes": [
"174531921704201773795594372300676260859",
"312661315948785305438634058546425896414",
"221860581993300452013222647744979991015",
"314473233638618434166516308080223199291",
"177095723285263561356689525325976337257",
"239265073563348170559306858305789065704",
"121384373516309451930289772580360023244",
"118022838513293996521388288842022556882",
"221778099946814380693429125042175906728",
"311807471554538287499496573203833481378"
],
"threshold": 0.9
},
"target": {
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9f4a6b3421e936c3ee9d74710243897d74dbaa2",
"id": "CVE-2025-38696-8fb1a5b8",
"digest": {
"line_hashes": [
"174531921704201773795594372300676260859",
"312661315948785305438634058546425896414",
"221860581993300452013222647744979991015",
"314473233638618434166516308080223199291",
"177095723285263561356689525325976337257",
"239265073563348170559306858305789065704",
"121384373516309451930289772580360023244",
"118022838513293996521388288842022556882",
"221778099946814380693429125042175906728",
"311807471554538287499496573203833481378"
],
"threshold": 0.9
},
"target": {
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e78033e59444d257d095b73ce5d20625294f6ec2",
"id": "CVE-2025-38696-b2804f60",
"digest": {
"function_hash": "339117677172509833881536753378752996540",
"length": 402.0
},
"target": {
"function": "mips_stack_top",
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f22de2027b206ddfb8a075800bb5d0dacf2da4b8",
"id": "CVE-2025-38696-bf6d63a2",
"digest": {
"line_hashes": [
"174531921704201773795594372300676260859",
"312661315948785305438634058546425896414",
"221860581993300452013222647744979991015",
"314473233638618434166516308080223199291",
"177095723285263561356689525325976337257",
"239265073563348170559306858305789065704",
"121384373516309451930289772580360023244",
"118022838513293996521388288842022556882",
"221778099946814380693429125042175906728",
"311807471554538287499496573203833481378"
],
"threshold": 0.9
},
"target": {
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b6839b572b503609b9b58bc6c04a816eefa0794",
"id": "CVE-2025-38696-d03eaa1d",
"digest": {
"function_hash": "339117677172509833881536753378752996540",
"length": 402.0
},
"target": {
"function": "mips_stack_top",
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd90dbd196831f5c2620736dc221db2634cf1e8e",
"id": "CVE-2025-38696-d8f3a370",
"digest": {
"line_hashes": [
"174531921704201773795594372300676260859",
"312661315948785305438634058546425896414",
"221860581993300452013222647744979991015",
"314473233638618434166516308080223199291",
"177095723285263561356689525325976337257",
"239265073563348170559306858305789065704",
"121384373516309451930289772580360023244",
"118022838513293996521388288842022556882",
"221778099946814380693429125042175906728",
"311807471554538287499496573203833481378"
],
"threshold": 0.9
},
"target": {
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24d098b6f69b0aa806ffcb3e18259bee31650b28",
"id": "CVE-2025-38696-f2ba8798",
"digest": {
"line_hashes": [
"174531921704201773795594372300676260859",
"312661315948785305438634058546425896414",
"221860581993300452013222647744979991015",
"314473233638618434166516308080223199291",
"177095723285263561356689525325976337257",
"239265073563348170559306858305789065704",
"121384373516309451930289772580360023244",
"118022838513293996521388288842022556882",
"221778099946814380693429125042175906728",
"311807471554538287499496573203833481378"
],
"threshold": 0.9
},
"target": {
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e78033e59444d257d095b73ce5d20625294f6ec2",
"id": "CVE-2025-38696-fec3feb3",
"digest": {
"line_hashes": [
"174531921704201773795594372300676260859",
"312661315948785305438634058546425896414",
"221860581993300452013222647744979991015",
"314473233638618434166516308080223199291",
"177095723285263561356689525325976337257",
"239265073563348170559306858305789065704",
"121384373516309451930289772580360023244",
"118022838513293996521388288842022556882",
"221778099946814380693429125042175906728",
"311807471554538287499496573203833481378"
],
"threshold": 0.9
},
"target": {
"file": "arch/mips/kernel/process.c"
},
"signature_type": "Line",
"signature_version": "v1"
}
]