A flaw in MIPS DEC firmware entry points causes the kernel to place the stack in a 64‑bit address region while the firmware code assumes a 32‑bit stack pointer. The 32‑bit firmware uses single‑word ALU operations on a 64‑bit value, producing unpredictable results that corrupt control flow. The result is a hard kernel panic during early boot, typically after the console output handler is invoked, with the kernel stopping around a console max‑pid calculation or later. This constitutes a denial‑of‑service impact, rendering the system unresponsive during bootstrap. This is a misuse of operand size leading to incorrect calculation (CWE‑681).

All Linux kernel builds for MIPS architectures that enable 64‑bit support and invoke the prom_printf() firmware entry point from a kernel thread other than the initial one. The issue is present across all vendors that ship the Linux kernel on MIPS devices, regardless of specific distribution, as the affected code is part of the upstream kernel sources. All kernel versions before the commit that introduces stack‑segment switching are vulnerable; specific affected revisions are listed in the associated patch links.

The CVSS score is 5.5. The vulnerability can cause a system‑wide boot failure, so it should be treated as medium severity. Because the flaw is exercised only by internal kernel code during early boot, an attacker would need privileged access to the kernel source or firmware to influence its behaviour, which is unlikely in a production environment. The EPSS score is 0.0021, and the vulnerability is not listed in CISA’s KEV catalog, indicating no widespread exploitation has been publicly confirmed. Nonetheless, if an attacker can supply malicious firmware or modify the device’s boot sequence, they could leverage this bug to deny service to the target system.