# CVE-2025-38696: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO

CVE-2025-38696 is fixed in linux on 1 platform, first by DEBIAN-CVE-2025-38696, released September 4, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2025-38696
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0020
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 4, 2025
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-38696

## Description

In the Linux kernel, the following vulnerability has been resolved:  MIPS: Don't crash in stack_top() for tasks without ABI or vDSO  Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash.  This can for example happen when using kunit:      mips_stack_top+0x28/0xc0     arch_pick_mmap_layout+0x190/0x220     kunit_vm_mmap_init+0xf8/0x138     __kunit_add_resource+0x40/0xa8     kunit_vm_mmap+0x88/0xd8     usercopy_test_init+0xb8/0x240     kunit_try_run_case+0x5c/0x1a8     kunit_generic_run_threadfn_adapter+0x28/0x50     kthread+0x118/0x240     ret_from_kernel_thread+0x14/0x1c  Only dereference the ABI point if it is set.  The GIC page is also included as it is specific to the vDSO. Also move the randomization adjustment into the same conditional.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.153-1 | [DEBIAN-CVE-2025-38696](https://patchblox.com/security/data/fix/linux/debian-cve-2025-38696.md) | Sep 4, 2025 |
| Linux | linux Debian 13.5 (trixie) | 6.12.43-1 | [DEBIAN-CVE-2025-38696](https://patchblox.com/security/data/fix/linux/debian-cve-2025-38696.md) | Sep 4, 2025 |
| Linux | linux Debian 14 | 6.16.3-1 | [DEBIAN-CVE-2025-38696](https://patchblox.com/security/data/fix/linux/debian-cve-2025-38696.md) | Sep 4, 2025 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.