The Linux kernel’s MIPS scheduler includes a flaw when the CONFIG_CPUMASK_OFFSTACK option is enabled. In this configuration cpumask_var_t is treated as a pointer, but the copy_from_user() call uses sizeof(new_mask), which evaluates to the pointer size instead of the intended buffer length. This causes the data copy to overwrite the mask pointer itself, corrupting kernel memory. The original code performed the unsafe copy before allocating storage, exacerbating the issue. The result is a memory corruption that can destabilize the kernel or allow escalation if manipulated in the right context.

The issue appears in any Linux kernel compiled for a MIPS architecture that enables CONFIG_CPUMASK_OFFSTACK. Many default distribution kernels and embedded builds use this option by default, so a wide range of systems could be impacted. Systems that disable the option are not affected.

With a CVSS score of 7.8, the vulnerability is considered high severity, while an EPSS score of less than 1 % indicates a low observed exploitation probability. The flaw is not listed in the CISA KEV catalog, meaning no publicly known exploits are recorded. The likely attack path requires an attacker to invoke the user‑supplied mask interface in the kernel, such as via cpumask manipulation functions or modules that read user data. If successfully triggered, the resulting memory corruption could cause a kernel crash, a denial of service, or potentially privilege escalation if the overwritten memory is leveraged strategically.