CVE-2025-38696— MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
Possible ATT&CK Techniques 1AI
T1583.001 · DomainsAffected Version Matrix 24
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | ea7e0480a4b695d0aa6b3fa99bd658a003122113< ab18e48a503230d675e824a0d68a108bdff42503 | affected |
ea7e0480a4b695d0aa6b3fa99bd658a003122113< e78033e59444d257d095b73ce5d20625294f6ec2 | affected | ||
ea7e0480a4b695d0aa6b3fa99bd658a003122113< bd90dbd196831f5c2620736dc221db2634cf1e8e | affected | ||
ea7e0480a4b695d0aa6b3fa99bd658a003122113< 5b6839b572b503609b9b58bc6c04a816eefa0794 | affected | ||
ea7e0480a4b695d0aa6b3fa99bd658a003122113< f22de2027b206ddfb8a075800bb5d0dacf2da4b8 | affected | ||
ea7e0480a4b695d0aa6b3fa99bd658a003122113< 82d140f6aab5e89a9d3972697a0dbe1498752d9b | affected | ||
ea7e0480a4b695d0aa6b3fa99bd658a003122113< 24d098b6f69b0aa806ffcb3e18259bee31650b28 | affected | ||
ea7e0480a4b695d0aa6b3fa99bd658a003122113< cddf47d20b0325dc8a4e57b833fe96e8f36c42a4 | affected | ||
| … +16 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-38696
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash. This can for example happen when using kunit: mips_stack_top+0x28/0xc0 arch_pick_mmap_layout+0x190/0x220 kunit_vm_mmap_init+0xf8/0x138 __kunit_add_resource+0x40/0xa8 kunit_vm_mmap+0x88/0xd8 usercopy_test_init+0xb8/0x240 kunit_try_run_case+0x5c/0x1a8 kunit_generic_run_threadfn_adapter+0x28/0x50 kthread+0x118/0x240 ret_from_kernel_thread+0x14/0x1c Only dereference the ABI point if it is set. The GIC page is also included as it is specific to the vDSO. Also move the randomization adjustment into the same conditional.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于stack_top函数未检查ABI空指针。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-38696
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-38696
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-38696 (1)
Same Patch Batch · Linux · 2025-09-04 · 52 CVEs total
| CVE-2025-38708 | 9.8 CRITICAL | drbd: add missing kref_get in handle_write_conflicts |
| CVE-2025-38724 | 9.8 CRITICAL | nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() |
| CVE-2025-38728 | 9.1 CRITICAL | smb3: fix for slab out of bounds on mount to ksmbd |
| CVE-2025-38688 | 8.8 HIGH | iommufd: Prevent ALIGN() overflow |
| CVE-2025-38697 | 7.8 HIGH | jfs: upper bound check of tree index in dbAllocAG |
| CVE-2025-38722 | 7.8 HIGH | habanalabs: fix UAF in export_dmabuf() |
| CVE-2025-38685 | 7.8 HIGH | fbdev: Fix vmalloc out-of-bounds write in fast_imageblit |
| CVE-2025-38718 | 7.8 HIGH | sctp: linearize cloned gso packets in sctp_rcv |
| CVE-2025-38717 | 7.8 HIGH | net: kcm: Fix race condition in kcm_unattach() |
| CVE-2025-38715 | 7.8 HIGH | hfs: fix slab-out-of-bounds in hfs_bnode_read() |
| CVE-2025-38710 | 7.8 HIGH | gfs2: Validate i_depth for exhash directories |
| CVE-2025-38730 | 7.8 HIGH | io_uring/net: commit partial buffers on retry |
| CVE-2025-38703 | 7.8 HIGH | drm/xe: Make dma-fences compliant with the safe access rules |
| CVE-2025-38714 | 7.8 HIGH | hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() |
| CVE-2025-38679 | 7.3 HIGH | media: venus: Fix OOB read due to missing payload bound check |
| CVE-2025-38687 | 7.3 HIGH | comedi: fix race between polling and detaching |
| CVE-2025-38713 | 7.1 HIGH | hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() |
| CVE-2025-38707 | 7.1 HIGH | fs/ntfs3: Add sanity check for file name |
| CVE-2025-38680 | media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() | |
| CVE-2025-38693 | media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_t |
Showing top 20 of 52 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-64565
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process - CVE-2026-64564
sctp: don't free the ASCONF's own transport in DEL-IP proces - CVE-2026-64563
rhashtable: clear stale iter->p on table restart - CVE-2026-64562
KVM: nVMX: Hide shadow VMCS right after VMCLEAR - CVE-2026-64561
KVM: x86: Check for invalid/obsolete root *after* making MMU
Same vendor: Linux
- CVE-2026-64565
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process - CVE-2026-64564
sctp: don't free the ASCONF's own transport in DEL-IP proces - CVE-2026-64563
rhashtable: clear stale iter->p on table restart - CVE-2026-64562
KVM: nVMX: Hide shadow VMCS right after VMCLEAR - CVE-2026-64561
KVM: x86: Check for invalid/obsolete root *after* making MMU
V. Comments for CVE-2025-38696
No comments yet