Security readout for executives and security teams
Plain-English summary
This is a Linux kernel reliability flaw on MIPS systems. Certain kernel tasks without normal user ABI or vDSO state can trigger a NULL pointer dereference and crash. The public record describes a fix, but provides no CVSS score and no evidence of active exploitation.
Executive priority
Treat as a targeted maintenance issue, not an emergency, unless your environment depends on exposed MIPS-based Linux appliances. Patch through normal kernel or vendor update channels and verify affected embedded systems are not overlooked.
Technical view
In MIPS stack_top(), the kernel dereferenced the task ABI pointer even when no ABI or vDSO was present. Kernel threads, including a cited KUnit path, can reach this logic through mmap layout setup. The fix only dereferences ABI-dependent values when present and keeps vDSO-specific GIC and randomization handling inside that condition.
Likely exposure
Exposure appears limited to Linux systems using affected MIPS kernel versions or downstream products that include those kernels. The source bundle lists multiple Linux stable branches and fix commits, plus a Debian LTS advisory. Non-MIPS kernels are not identified as affected in the supplied evidence.
Exploitation context
The supplied sources describe a kernel crash condition, not privilege escalation, remote code execution, or data exposure. KEV is false, and no source in the bundle states active exploitation. Evidence points to denial-of-service style impact if the vulnerable path is reachable.
Researcher notes
The public evidence is narrow: a MIPS stack_top NULL dereference involving tasks without ABI or vDSO, demonstrated through a KUnit-related path. Impact and reachability outside kernel test or internal paths are not fully established in the supplied bundle.
Mitigation direction
- Update affected Linux kernels to vendor-supported fixed builds.
- Prioritize MIPS systems and appliances using listed affected kernel branches.
- Review Debian LTS and device-vendor advisories for packaged fixes.
- If no package is available, track upstream stable fix commits with the vendor.
- Avoid custom backports without kernel regression testing.
Validation and detection
- Inventory systems running Linux on MIPS architecture.
- Map kernel versions against vendor advisories and fixed stable commits.
- Check package changelogs for CVE-2025-38696 or the referenced MIPS fix.
- Confirm rebooted systems are running the updated kernel.
- Review crash logs for stack_top or mips_stack_top NULL dereference traces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38696 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ab18e48a503230d675e824a0d68a108bdff42503CVE reference, Linux
- https://git.kernel.org/stable/c/e78033e59444d257d095b73ce5d20625294f6ec2CVE reference, Linux
- https://git.kernel.org/stable/c/bd90dbd196831f5c2620736dc221db2634cf1e8eCVE reference, Linux
- https://git.kernel.org/stable/c/5b6839b572b503609b9b58bc6c04a816eefa0794CVE reference, Linux
- https://git.kernel.org/stable/c/f22de2027b206ddfb8a075800bb5d0dacf2da4b8CVE reference, Linux
- https://git.kernel.org/stable/c/82d140f6aab5e89a9d3972697a0dbe1498752d9bCVE reference, Linux
- https://git.kernel.org/stable/c/24d098b6f69b0aa806ffcb3e18259bee31650b28CVE reference, Linux
- https://git.kernel.org/stable/c/cddf47d20b0325dc8a4e57b833fe96e8f36c42a4CVE reference, Linux
- https://git.kernel.org/stable/c/e9f4a6b3421e936c3ee9d74710243897d74dbaa2CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.