CVE-2025-38696

What it actually does

Null pointer dereference in MIPS stack_top() when the task's ABI pointer is NULL (e.g., kthreads or tasks without vDSO), causing a kernel crash on dereference.

Why it matters to the business

Unexpected kernel crashes or denial of service on MIPS-based systems during kernel testing, resource mapping, or internal task operations, with low likelihood of widespread exploitation due to age and low EPSS.

How an attack unfolds

An attacker or test harness triggers arch_pick_mmap_layout or similar paths that call stack_top() on a task lacking an ABI mapping, such as during kunit execution in the kernel; the NULL ABI dereference crashes the system. No named threat actors are associated with this specific issue despite unrelated privilege-escalation reports on Container-Optimized OS.

How to fix it

Upgrade affected Linux kernel packages to versions containing commit ab18e48a503230d675e824a0d68a108bdff42503 or later; for MinimOS Harbor components update to 2.11.2-r6 or newer. Rebuild and reboot systems after applying the fix.

How to confirm the fix worked

Verify the running kernel contains the referenced commit, confirm stack_top() now guards the ABI pointer, and re-run kunit tests or mmap-related workloads to ensure no crash occurs.

Typical attack path

1. Identify or create a MIPS kthread or task without ABI/vDSO
2. Invoke code paths that call arch_pick_mmap_layout or kunit_vm_mmap_init
3. Reach mips_stack_top which dereferences the NULL ABI pointer
4. Trigger kernel oops/panic and potential denial of service

How to detect it

Search kernel logs and crash dumps for stack traces containing mips_stack_top, arch_pick_mmap_layout, or kunit_vm_mmap_init; look for NULL pointer dereference panics on MIPS during kthread or kunit activity.

• mips_stack_top+0x28/0xc0
• arch_pick_mmap_layout+0x190/0x220
• kunit_vm_mmap_init+0xf8/0x138
• NULL ABI pointer dereference in stack_top

What your security team should do

• Apply the kernel fix immediately on all MIPS systems given the published date and potential for local denial of service
• Monitor kernel logs for mips_stack_top crashes as a sign of exposure
• Limit untrusted local code execution on affected MIPS platforms until patched
• Review downstream package dependencies for the updated kernel commit