LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71109: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits

In the Linux kernel, the following vulnerability has been resolved: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used, and this macro can generate more than 2 instructions. At the same time, the code in ftrace assumes that no more than 2 instructions can be generated, which is why it stores them in an int[2] array. However, as previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA) causes a buffer overflow when _mcount is beyond 32 bits. This leads to corruption of the variables located in the __read_mostly section. This corruption was observed because the variable __cpu_primary_thread_mask was corrupted, causing a hang very early during boot. This fix prevents the corruption by avoiding the generation of instructions if they could exceed 2 instructions in length. Fortunately, insn_la_mcount is only used if the instrumented code is located outside the kernel code section, so dynamic ftrace can still be used, albeit in a more limited scope. This is still preferable to corrupting memory and/or crashing the kernel.

HighCVSS 7.1Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel flaw can corrupt memory or crash certain MIPS systems when dynamic function tracing handles a kernel address beyond 32 bits. The observed failure was an early-boot hang. Exposure appears architecture- and configuration-specific, but affected systems face serious integrity and availability consequences.

Executive priority

Prioritize identification and patching of exposed MIPS systems, especially operationally critical appliances. Broad enterprise urgency is lower if no MIPS assets exist. Because the failure can prevent boot or corrupt kernel state, confirmed exposure warrants prompt remediation despite no cited active exploitation.

Technical view

The ftrace code allocated space for two generated instructions, while UASM_i_LA could emit more when _mcount was beyond 32 bits. The resulting buffer overflow corrupts nearby __read_mostly variables. The published fix avoids instruction generation when it could exceed the buffer, retaining dynamic ftrace with reduced scope.

Likely exposure

Likely exposure is limited to MIPS Linux kernels containing the vulnerable ftrace logic, with relevant tracing and address-placement conditions. The supplied version metadata lists several affected releases but is insufficiently clear for definitive range mapping. Downstream kernels require patch-level verification.

Exploitation context

The CVSS vector describes local access, low privileges, low complexity, and no user interaction, with high integrity and availability impact but no confidentiality impact. The bundle marks KEV false and provides no evidence of active exploitation. Observed impact was memory corruption causing an early-boot hang.

Researcher notes

The defect is an instruction-buffer size mismatch in MIPS ftrace generation, not a generic remote Linux flaw. Exploitability beyond denial of service or integrity impact is not established by the supplied sources. Exact vulnerable release boundaries and fix-to-branch mappings should be confirmed from kernel or downstream vendor records.

Mitigation direction

  • Inventory MIPS systems and record kernel versions, downstream patches, and dynamic ftrace usage.
  • Upgrade to a vendor kernel containing an applicable cited fix or backport.
  • If upgrading is delayed, consult vendor guidance before restricting dynamic ftrace on exposed MIPS systems.
  • Prioritize appliances or embedded systems where kernel failure would disrupt critical operations.

Validation and detection

  • Confirm whether each system uses MIPS architecture and includes dynamic ftrace support.
  • Verify the running kernel contains the applicable fix or an equivalent vendor backport.
  • Review vendor advisories because downstream version numbers may not match upstream affected metadata.
  • Test patched kernels under representative boot and tracing conditions before production rollout.
  • Monitor affected systems for unexplained early-boot hangs or kernel memory-corruption symptoms.
Prepared
Confidence
medium
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71109 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H1.85.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2025-71109Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe424054000878d7eb11e44289242886d6e219d22, e424054000878d7eb11e44289242886d6e219d22, e424054000878d7eb11e44289242886d6e219d22unaffected
LinuxLinux2.6.35, 0, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.