In 64‑bit MIPS Linux kernels, the early console output handler may be invoked by a kernel thread that is not the initial one. When this occurs, the buffer passed to the firmware’s printf() contains a 64‑bit address located on the stack within the XKPHYS memory segment. The firmware’s 32‑bit printf truncates this address, causing the console handler to dereference an invalid memory location and crash the kernel. The crash manifests as a paging request and oops trace, leading to a system halt. The flaw is rooted in placing the buffer on the stack in a 64‑bit segment rather than in a 32‑bit compatibility segment, resulting in incorrect address handling and a memory corruption vulnerability (CWE‑823) and an unspecified NVD-CWE-noinfo classification.

The vulnerability affects Linux kernel builds for 64‑bit MIPS architectures in which the final console driver is not enabled during configuration. It applies to all such kernels that employ the early console during bootstrap, regardless of specific kernel version, because the code path is unchanged across releases until the patch is applied.

The CVSS score of 5.5, but the EPSS score is below 1 % and the vulnerability is not cataloged in the CISA KEV registry. The issue requires kernel‑level execution; an attacker would need local privileged access or the ability to modify the kernel image or boot configuration. A successful exploitation results only in a denial‑of‑service (kernel crash) rather than remote code execution. The risk to a well‑configured system is therefore limited mainly to unintentional boot or configuration errors that keep the early console active beyond the expected bootstrap phase.