{
  "cveId": "CVE-2026-46250",
  "url": "https://patchblox.com/security/cve/CVE-2026-46250",
  "summary": "CVE-2026-46250 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-46250, released June 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "MIPS: Work around LLVM bug when gp is used as global register variable",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  MIPS: Work around LLVM bug when gp is used as global register variable  On MIPS, __current_thread_info is defined as global register variable locating in $gp, and is simply assigned with new address during kernel relocation.  This however is broken with LLVM, which always restores $gp if it finds $gp is clobbered in any form, including when intentionally through a global register variable. This is against GCC\u0027s documentation[1], which requires a callee-saved register used as global register variable not to be restored if it\u0027s clobbered.  As a result, $gp will continue to point to the unrelocated kernel after the epilog of relocate_kernel(), leading to an early crash in init_idle,  [    0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000000000000000, epc == ffffffff81afada8, ra == ffffffff81afad90 [    0.000000] Oops[#1]: [    0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Tainted: G        W           6.19.0-rc5-00262-gd3eeb99bbc99-dirty #188 VOLUNTARY [    0.000000] Tainted: [W]=WARN [    0.000000] Hardware name: loongson,loongson64v-4core-virtio [    0.000000] $ 0   : 0000000000000000 0000000000000000 0000000000000001 0000000000000000 [    0.000000] $ 4   : ffffffff80b80ec0 ffffffff80b53d48 0000000000000000 00000000000f4240 [    0.000000] $ 8   : 0000000000000100 ffffffff81d82f80 ffffffff81d82f80 0000000000000001 [    0.000000] $12   : 0000000000000000 ffffffff81776f58 00000000000005da 0000000000000002 [    0.000000] $16   : ffffffff80b80e40 0000000000000000 ffffffff80b81614 9800000005dfbe80 [    0.000000] $20   : 00000000540000e0 ffffffff81980000 0000000000000000 ffffffff80f81c80 [    0.000000] $24   : 0000000000000a26 ffffffff8114fb90 [    0.000000] $28   : ffffffff80b50000 ffffffff80b53d40 0000000000000000 ffffffff81afad90 [    0.000000] Hi    : 0000000000000000 [    0.000000] Lo    : 0000000000000000 [    0.000000] epc   : ffffffff81afada8 init_idle\u002B0x130/0x270 [    0.000000] ra    : ffffffff81afad90 init_idle\u002B0x118/0x270 [    0.000000] Status: 540000e2\tKX SX UX KERNEL EXL [    0.000000] Cause : 00000008 (ExcCode 02) [    0.000000] BadVA : 0000000000000000 [    0.000000] PrId  : 00006305 (ICT Loongson-3) [    0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____), tls=0000000000000000) [    0.000000] Stack : 9800000005dfbf00 ffffffff8178e950 0000000000000000 0000000000000000 [    0.000000]         0000000000000000 ffffffff81970000 000000000000003f ffffffff810a6528 [    0.000000]         0000000000000001 9800000005dfbe80 9800000005dfbf00 ffffffff81980000 [    0.000000]         ffffffff810a6450 ffffffff81afb6c0 0000000000000000 ffffffff810a2258 [    0.000000]         ffffffff81d82ec8 ffffffff8198d010 ffffffff81b67e80 ffffffff8197dd98 [    0.000000]         ffffffff81d81c80 ffffffff81930000 0000000000000040 0000000000000000 [    0.000000]         0000000000000000 0000000000000000 0000000000000000 0000000000000000 [    0.000000]         0000000000000000 000000000000009e ffffffff9fc01000 0000000000000000 [    0.000000]         0000000000000000 0000000000000000 0000000000000000 0000000000000000 [    0.000000]         0000000000000000 ffffffff81ae86dc ffffffff81b3c741 0000000000000002 [    0.000000]         ... [    0.000000] Call Trace: [    0.000000] [\u003Cffffffff81afada8\u003E] init_idle\u002B0x130/0x270 [    0.000000] [\u003Cffffffff81afb6c0\u003E] sched_init\u002B0x5c8/0x6c0 [    0.000000] [\u003Cffffffff81ae86dc\u003E] start_kernel\u002B0x27c/0x7a8  This bug has been reported to LLVM[2] and affects version from (at least) 18 to 21. Let\u0027s work around this by using inline assembly to assign $gp before a fix is widely available.",
  "published": "2026-06-03T18:16:25Z",
  "severity": "Moderate",
  "cvss": 7.3,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
  "epss": 0.00128,
  "epssPercentile": 0.02491,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-46250",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.170-1",
      "fix": "DEBIAN-CVE-2026-46250",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-46250",
      "released": "2026-06-24T14:07:24Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.85-1",
      "fix": "DEBIAN-CVE-2026-46250",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-46250",
      "released": "2026-06-24T14:07:24Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.18.14-1",
      "fix": "DEBIAN-CVE-2026-46250",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-46250",
      "released": "2026-06-24T14:07:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}