CVE-2025-71109: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits
In the Linux kernel, the following vulnerability has been resolved:
MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits
Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of
dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used,
and this macro can generate more than 2 instructions. At the same
time, the code in ftrace assumes that no more than 2 instructions can
be generated, which is why it stores them in an int[2] array. However,
as previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA)
causes a buffer overflow when _mcount is beyond 32 bits. This leads to
corruption of the variables located in the __read_mostly section.
This corruption was observed because the variable
__cpu_primary_thread_mask was corrupted, causing a hang very early
during boot.
This fix prevents the corruption by avoiding the generation of
instructions if they could exceed 2 instructions in
length. Fortunately, insn_la_mcount is only used if the instrumented
code is located outside the kernel code section, so dynamic ftrace can
still be used, albeit in a more limited scope. This is still
preferable to corrupting memory and/or crashing the kernel.
Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw can corrupt memory or crash certain MIPS systems when dynamic function tracing handles a kernel address beyond 32 bits. The observed failure was an early-boot hang. Exposure appears architecture- and configuration-specific, but affected systems face serious integrity and availability consequences.
Executive priority
Prioritize identification and patching of exposed MIPS systems, especially operationally critical appliances. Broad enterprise urgency is lower if no MIPS assets exist. Because the failure can prevent boot or corrupt kernel state, confirmed exposure warrants prompt remediation despite no cited active exploitation.
Technical view
The ftrace code allocated space for two generated instructions, while UASM_i_LA could emit more when _mcount was beyond 32 bits. The resulting buffer overflow corrupts nearby __read_mostly variables. The published fix avoids instruction generation when it could exceed the buffer, retaining dynamic ftrace with reduced scope.
Likely exposure
Likely exposure is limited to MIPS Linux kernels containing the vulnerable ftrace logic, with relevant tracing and address-placement conditions. The supplied version metadata lists several affected releases but is insufficiently clear for definitive range mapping. Downstream kernels require patch-level verification.
Exploitation context
The CVSS vector describes local access, low privileges, low complexity, and no user interaction, with high integrity and availability impact but no confidentiality impact. The bundle marks KEV false and provides no evidence of active exploitation. Observed impact was memory corruption causing an early-boot hang.
Researcher notes
The defect is an instruction-buffer size mismatch in MIPS ftrace generation, not a generic remote Linux flaw. Exploitability beyond denial of service or integrity impact is not established by the supplied sources. Exact vulnerable release boundaries and fix-to-branch mappings should be confirmed from kernel or downstream vendor records.
Mitigation direction
Inventory MIPS systems and record kernel versions, downstream patches, and dynamic ftrace usage.
Upgrade to a vendor kernel containing an applicable cited fix or backport.
If upgrading is delayed, consult vendor guidance before restricting dynamic ftrace on exposed MIPS systems.
Prioritize appliances or embedded systems where kernel failure would disrupt critical operations.
Validation and detection
Confirm whether each system uses MIPS architecture and includes dynamic ftrace support.
Verify the running kernel contains the applicable fix or an equivalent vendor backport.
Review vendor advisories because downstream version numbers may not match upstream affected metadata.
Test patched kernels under representative boot and tracing conditions before production rollout.
Monitor affected systems for unexplained early-boot hangs or kernel memory-corruption symptoms.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-71109 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
0ADP providers
4Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.