In the Linux kernel, the following vulnerability has been resolved:

mips: sched: Fix CPUMASK_OFFSTACK memory corruption

This patch addresses a critical memory management flaw. When
CONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer.
Consequently, sizeof(new_mask) evaluates to the pointer size, causing
copy_from_user() to clobber the mask pointer. Furthermore, the old
logic performed copy_from_user() before allocating the mask.

Fix this by allocating new_mask first. To handle variable-sized user
masks correctly, use cpumask_size() to truncate overly large user masks
or pad undersized masks with zeros before copying the data directly into
the allocated buffer.

https://git.kernel.org/stable/c/15ba8053fe4162c933855f1676fb321cdb6251c7

https://git.kernel.org/stable/c/1caee6e084a96ada94658f261ced377d85af3f03

https://git.kernel.org/stable/c/3446ffb5d03c36f9ce88ede7ca5be319a2968d96

https://git.kernel.org/stable/c/87a56c1e8e36d06ebe8640432f911538ded7827d

https://git.kernel.org/stable/c/98e37db4a34d3af3fb2f4648295c25b5e40b20e3

https://git.kernel.org/stable/c/a1dd41d00c57efb1fbc6f361c5f48c9d00cca51c

https://git.kernel.org/stable/c/d20ee42f8226607b5693b2bc2f115ca2d270221a

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/mips/kernel/mips-mt-fpaff.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"295cbf6d63165fe4253cf1d9ceadcda47a318b48","lessThan":"d20ee42f8226607b5693b2bc2f115ca2d270221a","versionType":"git","status":"affected"},{"version":"295cbf6d63165fe4253cf1d9ceadcda47a318b48","lessThan":"15ba8053fe4162c933855f1676fb321cdb6251c7","versionType":"git","status":"affected"},{"version":"295cbf6d63165fe4253cf1d9ceadcda47a318b48","lessThan":"3446ffb5d03c36f9ce88ede7ca5be319a2968d96","versionType":"git","status":"affected"},{"version":"295cbf6d63165fe4253cf1d9ceadcda47a318b48","lessThan":"87a56c1e8e36d06ebe8640432f911538ded7827d","versionType":"git","status":"affected"},{"version":"295cbf6d63165fe4253cf1d9ceadcda47a318b48","lessThan":"1caee6e084a96ada94658f261ced377d85af3f03","versionType":"git","status":"affected"},{"version":"295cbf6d63165fe4253cf1d9ceadcda47a318b48","lessThan":"a1dd41d00c57efb1fbc6f361c5f48c9d00cca51c","versionType":"git","status":"affected"},{"version":"295cbf6d63165fe4253cf1d9ceadcda47a318b48","lessThan":"98e37db4a34d3af3fb2f4648295c25b5e40b20e3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/mips/kernel/mips-mt-fpaff.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.23","status":"affected"},{"version":"0","lessThan":"2.6.23","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]