{"api_version":"1","generated_at":"2026-07-24T18:27:05+00:00","cve":"CVE-2026-64252","urls":{"html":"https://cve.report/CVE-2026-64252","api":"https://cve.report/api/cve/CVE-2026-64252.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-64252","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-64252"},"summary":{"title":"MIPS: DEC: Prevent initial console buffer from landing in XKPHYS","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: DEC: Prevent initial console buffer from landing in XKPHYS\n\nIn 64-bit configurations calling the initial console output handler from\na kernel thread other than the initial one will result in a situation\nwhere the stack has been placed in the XKPHYS 64-bit memory segment and\nconsequently so has been the buffer allocated there that is used as the\nargument corresponding to the `%s' output conversion specifier for the\nfirmware's printf() entry point.\n\nThis 64-bit address will then be truncated by 32-bit firmware, resulting\nin an attempt to access the wrong memory location, which in turn will\ncause all kinds of unpredictable behaviour, such as a kernel crash:\n\n  Console: colour dummy device 160x64\n  Calibrating delay loop... 49.36 BogoMIPS (lpj=192512)\n  pid_max: default: 32768 minimum: 301\n  CPU 0 Unable to handle kernel paging request at virtual address 000000000203bd00, epc == ffffffffbfc08364, ra == ffffffffbfc08800\n  Oops[#1]:\n  CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc2-00254-gfb649bda6f56-dirty #121\n  $ 0   : 0000000000000000 0000000000000001 0000000000000023 ffffffff80684ba0\n  $ 4   : 000000000203bd00 ffffffffbfc0f3b4 ffffffffffffffff 0000000000000073\n  $ 8   : 0a303d7469000000 0000000000000000 0000000000000073 ffffffffbfc0f473\n  $12   : 0000000000000002 0000000000000000 ffffffff80684c1c 0000000000000000\n  $16   : 0000000000000000 ffffffff80596dc9 0000000000000000 ffffffffbfc09240\n  $20   : ffffffff80684c40 ffffffffbfc0f400 000000000000002d 000000000000002b\n  $24   : ffffffffffffffbf 000000000203bd00\n  $28   : ffffffff805f0000 ffffffff80684b58 0000000000000030 ffffffffbfc08800\n  Hi    : 0000000000000000\n  Lo    : 0000000000000aa8\n  epc   : ffffffffbfc08364 0xffffffffbfc08364\n  ra    : ffffffffbfc08800 0xffffffffbfc08800\n  Status: 140120e2        KX SX UX KERNEL EXL\n  Cause : 00000008 (ExcCode 02)\n  BadVA : 000000000203bd00\n  PrId  : 00000430 (R4000SC)\n  Modules linked in:\n  Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____), tls=0000000000000000)\n  Stack : 0000000000000000 0000000000000000 0000000000000000 0000004d0000004d\n          80684cc0806a2a40 80596dc80000004d 8061000000000000 bfc0850c80684c38\n          0000000000000000 000000000203bd00 0000000000000000 0000000000000000\n          0000000000000000 00000000bfc0f3b4 0000000000000000 0000000000000000\n          0000000000000000 0000000000000000 0000000000000000 0000000000000000\n          0000000000000000 0000000000000000 0000000000000000 0000000000000000\n          0000002500000000 0000000000000000 0000000000000000 802c1a7400000000\n          0203bd0080596dc8 0203bd4d69000000 6c61632000000018 5f746567646e6172\n          6c616320625f6d6f 5f736e5f6d6f7266 206361323778302b 303d74696e726320\n          806a0a38806b0000 806a0a38806b0000 00000000806b0000 80683c58806b0000\n          ...\n  Call Trace:\n\n  Code: a082ffff  03e00008  00601021 <80820000> 00001821  10400005  24840001  80820000  24630001\n\n  ---[ end trace 0000000000000000 ]---\n  Kernel panic - not syncing: Fatal exception in interrupt\n\n  KN04 V2.1k    (PC: 0xa0026768, SP: 0x806848e8)\n  >>\n\nIn this case the pointer in $4 was truncated from 0x980000000203bd00 to\n0x000000000203bd00.\n\nThis may happen when no final console driver has been enabled in the\nconfiguration and consequently the initial console continues being used\nlate into bootstrap or with an upcoming change that will switch the zs\ndriver to use a platform device, which in turn will make the console\nhandover happen only after other kernel threads have already been\nstarted.\n\nFix the issue by making the buffer static and initdata, and therefore\nplaced in the CKSEG0 32-bit compatibility segment, observing that the\nconsole output handler is called with the console lock held, implying\nno need for this code to be reentrant.  Add an assertion to verify the\nbuffer actually has been placed in a compatibility segment.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-07-24 16:16:54","updated_at":"2026-07-24 16:16:54"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/1c80327dedf05b8c8ca025b76c21235b19dd3a86","name":"https://git.kernel.org/stable/c/1c80327dedf05b8c8ca025b76c21235b19dd3a86","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8a15826e5d3bdcfbef2f8e9330c69ea9ee7282e7","name":"https://git.kernel.org/stable/c/8a15826e5d3bdcfbef2f8e9330c69ea9ee7282e7","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/35212f2adc2cf15122b96b987519de235b855e46","name":"https://git.kernel.org/stable/c/35212f2adc2cf15122b96b987519de235b855e46","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7fb13fd35110ebe95eb053faf79d018f51144d85","name":"https://git.kernel.org/stable/c/7fb13fd35110ebe95eb053faf79d018f51144d85","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/07c245bc39f94481fd75ff1ed54f7ab97111f3dd","name":"https://git.kernel.org/stable/c/07c245bc39f94481fd75ff1ed54f7ab97111f3dd","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ab465495b1ed5efb7d2f9b90d8b20b1e0473e26f","name":"https://git.kernel.org/stable/c/ab465495b1ed5efb7d2f9b90d8b20b1e0473e26f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9e22b6fc6532cd566dad6d89d8fb3885248e364a","name":"https://git.kernel.org/stable/c/9e22b6fc6532cd566dad6d89d8fb3885248e364a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6e61fc2e06e44b6d30248cc5bc47a58e75c2b43e","name":"https://git.kernel.org/stable/c/6e61fc2e06e44b6d30248cc5bc47a58e75c2b43e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64252","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64252","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 9e22b6fc6532cd566dad6d89d8fb3885248e364a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 1c80327dedf05b8c8ca025b76c21235b19dd3a86 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 8a15826e5d3bdcfbef2f8e9330c69ea9ee7282e7 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ab465495b1ed5efb7d2f9b90d8b20b1e0473e26f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 35212f2adc2cf15122b96b987519de235b855e46 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 6e61fc2e06e44b6d30248cc5bc47a58e75c2b43e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 07c245bc39f94481fd75ff1ed54f7ab97111f3dd git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 7fb13fd35110ebe95eb053faf79d018f51144d85 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.12","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.12 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.260 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.211 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.177 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.144 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.95 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.38 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.3 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/mips/dec/prom/console.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9e22b6fc6532cd566dad6d89d8fb3885248e364a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"1c80327dedf05b8c8ca025b76c21235b19dd3a86","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"8a15826e5d3bdcfbef2f8e9330c69ea9ee7282e7","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ab465495b1ed5efb7d2f9b90d8b20b1e0473e26f","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"35212f2adc2cf15122b96b987519de235b855e46","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6e61fc2e06e44b6d30248cc5bc47a58e75c2b43e","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"07c245bc39f94481fd75ff1ed54f7ab97111f3dd","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"7fb13fd35110ebe95eb053faf79d018f51144d85","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/mips/dec/prom/console.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.260","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.211","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.177","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.144","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.95","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.38","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.260","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.211","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.177","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.144","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.95","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.38","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.3","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc1","versionStartIncluding":"2.6.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: DEC: Prevent initial console buffer from landing in XKPHYS\n\nIn 64-bit configurations calling the initial console output handler from\na kernel thread other than the initial one will result in a situation\nwhere the stack has been placed in the XKPHYS 64-bit memory segment and\nconsequently so has been the buffer allocated there that is used as the\nargument corresponding to the `%s' output conversion specifier for the\nfirmware's printf() entry point.\n\nThis 64-bit address will then be truncated by 32-bit firmware, resulting\nin an attempt to access the wrong memory location, which in turn will\ncause all kinds of unpredictable behaviour, such as a kernel crash:\n\n  Console: colour dummy device 160x64\n  Calibrating delay loop... 49.36 BogoMIPS (lpj=192512)\n  pid_max: default: 32768 minimum: 301\n  CPU 0 Unable to handle kernel paging request at virtual address 000000000203bd00, epc == ffffffffbfc08364, ra == ffffffffbfc08800\n  Oops[#1]:\n  CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc2-00254-gfb649bda6f56-dirty #121\n  $ 0   : 0000000000000000 0000000000000001 0000000000000023 ffffffff80684ba0\n  $ 4   : 000000000203bd00 ffffffffbfc0f3b4 ffffffffffffffff 0000000000000073\n  $ 8   : 0a303d7469000000 0000000000000000 0000000000000073 ffffffffbfc0f473\n  $12   : 0000000000000002 0000000000000000 ffffffff80684c1c 0000000000000000\n  $16   : 0000000000000000 ffffffff80596dc9 0000000000000000 ffffffffbfc09240\n  $20   : ffffffff80684c40 ffffffffbfc0f400 000000000000002d 000000000000002b\n  $24   : ffffffffffffffbf 000000000203bd00\n  $28   : ffffffff805f0000 ffffffff80684b58 0000000000000030 ffffffffbfc08800\n  Hi    : 0000000000000000\n  Lo    : 0000000000000aa8\n  epc   : ffffffffbfc08364 0xffffffffbfc08364\n  ra    : ffffffffbfc08800 0xffffffffbfc08800\n  Status: 140120e2        KX SX UX KERNEL EXL\n  Cause : 00000008 (ExcCode 02)\n  BadVA : 000000000203bd00\n  PrId  : 00000430 (R4000SC)\n  Modules linked in:\n  Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____), tls=0000000000000000)\n  Stack : 0000000000000000 0000000000000000 0000000000000000 0000004d0000004d\n          80684cc0806a2a40 80596dc80000004d 8061000000000000 bfc0850c80684c38\n          0000000000000000 000000000203bd00 0000000000000000 0000000000000000\n          0000000000000000 00000000bfc0f3b4 0000000000000000 0000000000000000\n          0000000000000000 0000000000000000 0000000000000000 0000000000000000\n          0000000000000000 0000000000000000 0000000000000000 0000000000000000\n          0000002500000000 0000000000000000 0000000000000000 802c1a7400000000\n          0203bd0080596dc8 0203bd4d69000000 6c61632000000018 5f746567646e6172\n          6c616320625f6d6f 5f736e5f6d6f7266 206361323778302b 303d74696e726320\n          806a0a38806b0000 806a0a38806b0000 00000000806b0000 80683c58806b0000\n          ...\n  Call Trace:\n\n  Code: a082ffff  03e00008  00601021 <80820000> 00001821  10400005  24840001  80820000  24630001\n\n  ---[ end trace 0000000000000000 ]---\n  Kernel panic - not syncing: Fatal exception in interrupt\n\n  KN04 V2.1k    (PC: 0xa0026768, SP: 0x806848e8)\n  >>\n\nIn this case the pointer in $4 was truncated from 0x980000000203bd00 to\n0x000000000203bd00.\n\nThis may happen when no final console driver has been enabled in the\nconfiguration and consequently the initial console continues being used\nlate into bootstrap or with an upcoming change that will switch the zs\ndriver to use a platform device, which in turn will make the console\nhandover happen only after other kernel threads have already been\nstarted.\n\nFix the issue by making the buffer static and initdata, and therefore\nplaced in the CKSEG0 32-bit compatibility segment, observing that the\nconsole output handler is called with the console lock held, implying\nno need for this code to be reentrant.  Add an assertion to verify the\nbuffer actually has been placed in a compatibility segment."}],"providerMetadata":{"dateUpdated":"2026-07-24T15:31:19.344Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/9e22b6fc6532cd566dad6d89d8fb3885248e364a"},{"url":"https://git.kernel.org/stable/c/1c80327dedf05b8c8ca025b76c21235b19dd3a86"},{"url":"https://git.kernel.org/stable/c/8a15826e5d3bdcfbef2f8e9330c69ea9ee7282e7"},{"url":"https://git.kernel.org/stable/c/ab465495b1ed5efb7d2f9b90d8b20b1e0473e26f"},{"url":"https://git.kernel.org/stable/c/35212f2adc2cf15122b96b987519de235b855e46"},{"url":"https://git.kernel.org/stable/c/6e61fc2e06e44b6d30248cc5bc47a58e75c2b43e"},{"url":"https://git.kernel.org/stable/c/07c245bc39f94481fd75ff1ed54f7ab97111f3dd"},{"url":"https://git.kernel.org/stable/c/7fb13fd35110ebe95eb053faf79d018f51144d85"}],"title":"MIPS: DEC: Prevent initial console buffer from landing in XKPHYS","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-64252","datePublished":"2026-07-24T15:31:19.344Z","dateReserved":"2026-07-19T15:36:31.773Z","dateUpdated":"2026-07-24T15:31:19.344Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-24 16:16:54","lastModifiedDate":"2026-07-24 16:16:54","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"64252","Ordinal":"1","Title":"MIPS: DEC: Prevent initial console buffer from landing in XKPHYS","CVE":"CVE-2026-64252","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"64252","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: DEC: Prevent initial console buffer from landing in XKPHYS\n\nIn 64-bit configurations calling the initial console output handler from\na kernel thread other than the initial one will result in a situation\nwhere the stack has been placed in the XKPHYS 64-bit memory segment and\nconsequently so has been the buffer allocated there that is used as the\nargument corresponding to the `%s' output conversion specifier for the\nfirmware's printf() entry point.\n\nThis 64-bit address will then be truncated by 32-bit firmware, resulting\nin an attempt to access the wrong memory location, which in turn will\ncause all kinds of unpredictable behaviour, such as a kernel crash:\n\n  Console: colour dummy device 160x64\n  Calibrating delay loop... 49.36 BogoMIPS (lpj=192512)\n  pid_max: default: 32768 minimum: 301\n  CPU 0 Unable to handle kernel paging request at virtual address 000000000203bd00, epc == ffffffffbfc08364, ra == ffffffffbfc08800\n  Oops[#1]:\n  CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc2-00254-gfb649bda6f56-dirty #121\n  $ 0   : 0000000000000000 0000000000000001 0000000000000023 ffffffff80684ba0\n  $ 4   : 000000000203bd00 ffffffffbfc0f3b4 ffffffffffffffff 0000000000000073\n  $ 8   : 0a303d7469000000 0000000000000000 0000000000000073 ffffffffbfc0f473\n  $12   : 0000000000000002 0000000000000000 ffffffff80684c1c 0000000000000000\n  $16   : 0000000000000000 ffffffff80596dc9 0000000000000000 ffffffffbfc09240\n  $20   : ffffffff80684c40 ffffffffbfc0f400 000000000000002d 000000000000002b\n  $24   : ffffffffffffffbf 000000000203bd00\n  $28   : ffffffff805f0000 ffffffff80684b58 0000000000000030 ffffffffbfc08800\n  Hi    : 0000000000000000\n  Lo    : 0000000000000aa8\n  epc   : ffffffffbfc08364 0xffffffffbfc08364\n  ra    : ffffffffbfc08800 0xffffffffbfc08800\n  Status: 140120e2        KX SX UX KERNEL EXL\n  Cause : 00000008 (ExcCode 02)\n  BadVA : 000000000203bd00\n  PrId  : 00000430 (R4000SC)\n  Modules linked in:\n  Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____), tls=0000000000000000)\n  Stack : 0000000000000000 0000000000000000 0000000000000000 0000004d0000004d\n          80684cc0806a2a40 80596dc80000004d 8061000000000000 bfc0850c80684c38\n          0000000000000000 000000000203bd00 0000000000000000 0000000000000000\n          0000000000000000 00000000bfc0f3b4 0000000000000000 0000000000000000\n          0000000000000000 0000000000000000 0000000000000000 0000000000000000\n          0000000000000000 0000000000000000 0000000000000000 0000000000000000\n          0000002500000000 0000000000000000 0000000000000000 802c1a7400000000\n          0203bd0080596dc8 0203bd4d69000000 6c61632000000018 5f746567646e6172\n          6c616320625f6d6f 5f736e5f6d6f7266 206361323778302b 303d74696e726320\n          806a0a38806b0000 806a0a38806b0000 00000000806b0000 80683c58806b0000\n          ...\n  Call Trace:\n\n  Code: a082ffff  03e00008  00601021 <80820000> 00001821  10400005  24840001  80820000  24630001\n\n  ---[ end trace 0000000000000000 ]---\n  Kernel panic - not syncing: Fatal exception in interrupt\n\n  KN04 V2.1k    (PC: 0xa0026768, SP: 0x806848e8)\n  >>\n\nIn this case the pointer in $4 was truncated from 0x980000000203bd00 to\n0x000000000203bd00.\n\nThis may happen when no final console driver has been enabled in the\nconfiguration and consequently the initial console continues being used\nlate into bootstrap or with an upcoming change that will switch the zs\ndriver to use a platform device, which in turn will make the console\nhandover happen only after other kernel threads have already been\nstarted.\n\nFix the issue by making the buffer static and initdata, and therefore\nplaced in the CKSEG0 32-bit compatibility segment, observing that the\nconsole output handler is called with the console lock held, implying\nno need for this code to be reentrant.  Add an assertion to verify the\nbuffer actually has been placed in a compatibility segment.","Type":"Description","Title":"MIPS: DEC: Prevent initial console buffer from landing in XKPHYS"}]}}}