CVE-2026-64252: Linux Kernel Privilege Escalation Flaw

CVE-2026-64252 Overview

CVE-2026-64252 is a Linux kernel vulnerability affecting the MIPS DECstation (DEC) architecture support code. The flaw involves the initial console output handler placing its buffer in the XKPHYS 64-bit memory segment when invoked from a kernel thread other than the initial one. When the 32-bit firmware's printf() entry point receives this 64-bit address, it truncates the pointer, causing access to an incorrect memory location and unpredictable behavior including kernel panics.

Critical Impact
The address truncation triggers a kernel paging fault and a fatal exception in interrupt context, leading to a full kernel panic on affected 64-bit MIPS DEC systems.

Affected Products

Linux kernel with CONFIG_MACH_DECSTATION on 64-bit MIPS configurations
Kernel versions prior to the fixes distributed across the referenced stable commits
Systems relying on the initial console handler late during bootstrap

Discovery Timeline

2026-07-24 - CVE-2026-64252 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64252

Vulnerability Analysis

The vulnerability resides in the MIPS DEC platform code that provides an initial console before a full console driver is registered. On 64-bit builds, when the console handler is called from a kernel thread other than the initial one, the current stack is located in the XKPHYS segment. Any automatic buffer allocated on that stack, including the buffer passed to the firmware printf() routine via the %s conversion, receives a 64-bit XKPHYS address.

The DECstation PROM firmware is 32-bit and treats pointer arguments as 32-bit values. When it receives an XKPHYS pointer such as 0x980000000203bd00, it truncates the upper bits and dereferences 0x000000000203bd00. That address is not mapped, producing the observed Unable to handle kernel paging request oops and subsequent panic.

Root Cause

The root cause is a mismatch between kernel and firmware address widths combined with buffer placement. The buffer used for firmware output was allocated on a stack that could be located outside the CKSEG0 32-bit compatibility segment, so the address handed to the firmware could not be represented in 32 bits.

Attack Vector

The defect manifests during bootstrap on 64-bit MIPS DEC configurations, particularly when no final console driver is enabled or when the console handover is deferred until other kernel threads have started. It is a reliability and stability defect rather than a remotely reachable input-driven flaw, and no exploit is reported. Reachability requires code paths that invoke the initial console output from a non-initial kernel thread on affected hardware.

The fix makes the buffer static and __initdata, forcing placement in the CKSEG0 32-bit compatibility segment. An assertion verifies that the buffer resides in a compatibility segment. Because the console output handler is invoked with the console lock held, the code path does not require reentrancy, making a single static buffer safe.

Detection Methods for CVE-2026-64252

Indicators of Compromise

Kernel oops messages of the form Unable to handle kernel paging request at virtual address originating from the MIPS DEC initial console code path during boot.
Kernel panic - not syncing: Fatal exception in interrupt on 64-bit MIPS DECstation systems shortly after Calibrating delay loop output.
Faulting virtual addresses that match a 32-bit truncation of an XKPHYS address (upper bits stripped).

Detection Strategies

Inventory MIPS DEC systems and identify kernels built with 64-bit configurations that have not incorporated the referenced stable commits.
Compare running kernel commit hashes against the fix commits 07c245bc, 1c80327d, 35212f2a, 6e61fc2e, 7fb13fd3, 8a15826e, 9e22b6fc, and ab465495.
Capture serial console logs during bootstrap to identify pre-panic oops signatures characteristic of this issue.

Monitoring Recommendations

Aggregate kernel serial and dmesg output centrally to detect early-boot oops or panic patterns tied to the DEC console handler.
Track kernel package versions across MIPS fleets and alert on hosts not running a patched build.
Monitor boot success telemetry so repeated boot failures on affected hardware are surfaced quickly.

How to Mitigate CVE-2026-64252

Immediate Actions Required

Update affected Linux kernels on MIPS DEC systems to a stable release that includes the fix commits listed by kernel.org.
Rebuild custom kernels from a tree that includes the referenced patches before redeploying to DECstation hardware.
Validate that boot completes cleanly on representative 64-bit MIPS DEC hardware after applying the patch.

Patch Information

The fix is distributed across multiple stable branches. Reference the upstream commits: 07c245bc, 1c80327d, 35212f2a, 6e61fc2e, 7fb13fd3, 8a15826e, 9e22b6fc, and ab465495. The patch relocates the firmware output buffer into the CKSEG0 32-bit compatibility segment and adds an assertion to enforce the placement.

Workarounds

Enable a final console driver in the kernel configuration so that the initial console is only used briefly before handover.
Build affected systems as 32-bit kernels where feasible, since the truncation issue is specific to 64-bit XKPHYS placement.
Avoid configurations that defer console handover until after additional kernel threads have started on DEC hardware.

bash

# Verify the running kernel includes one of the fix commits
uname -r
zcat /proc/config.gz | grep -E 'CONFIG_MACH_DECSTATION|CONFIG_64BIT'