The vulnerability arises from a missing ordering guarantee for the load‑linked (lld) and store‑conditional (scd) instructions on MIPSI6500 CPU cores. In the Linux kernel, when CONFIG_WEAK_REORDERING_BEYOND_LLSC is selected from the CONFIG_EYEQ configuration family, these instructions can be reordered by the CPU, violating the full‑ordering assumption that arch_cmpxchg() relies on. This flaw allows an attacker to cause the kernel to dereference an invalid pointer, leading to an Oops or page fault at virtual address zero and ultimately a kernel panic. The result is a denial of service that can bring the entire host down.

The issue affects Linux kernel builds that enable CONFIG_EYEQ on MIPS‑based platforms, specifically the I6500 CPU. Any kernel compiled with this configuration path and exposing lld/scd loops—such as anonymous pipe handling, pipe_race tests, or XDP test suites—carries the flaw. No specific kernel release is listed, so unpatched kernels with this configuration remain vulnerable.

Based on the description, it is inferred that an attacker must have local or privileged execution to trigger the vulnerable code path, such as by launching a reader/writer pair on an anonymous pipe. The EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, indicating a very low likelihood of exploitation. However, a successful exploitation results in a kernel crash, so the impact is high severity with a CVSS score of 7.8 and the risk is considered high. No publicly available exploit documented, but the flaw should be treated as high priority because exercising the vulnerable kernel code paths can bring the host down.