Linux Kernel EUVD-2026-59213

Exploitation requires a MIPS-architecture Linux kernel with the regulator subsystem compiled in (CONFIG_REGULATOR enabled) - the bug is latent and non-exploitable on x86, ARM, SPARC, and PowerPC. The attacker must hold a local shell with at minimum low-privilege user access (PR:L per CVSS vector), sufficient to trigger concurrent kernel regulator operations on the same pair of regulator objects. The specific timing window arises only when ww_mutex_lock() returns -EDEADLK during contention, which requires concurrent threads or processes to be racing on regulator acquisition simultaneously. No network access, no user interaction, and no special application-layer configuration are required, but the combination of MIPS hardware, regulator subsystem activity, and a concurrent-access race condition together form the required trigger. On all other architectures the bug is numerically invisible. SPARC and PowerPC also have differing EDEADLK/EDEADLOCK values but the regulator core is not built on those platforms, so they are not affected.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is architecturally justified but practically narrower than the raw number implies: the functional impact is confined to MIPS-architecture Linux systems where the regulator subsystem is active, a subset of the broader Linux deployment universe. The EPSS score of 0.22% at the 13th percentile is consistent with an architecture-specific kernel defect unlikely to attract automated exploitation. This vulnerability is not listed in CISA KEV and no public exploit code has been identified, meaning the exploitation status is speculative rather than confirmed. The C:H/I:H/A:H ratings reflect the theoretical severity of asymmetric kernel locking state - which can manifest as kernel panics (A:H) or exploitable memory corruption (C:H/I:H) - but converting that theoretical impact into a reliable exploit requires triggering a specific ww_mutex contention race on MIPS hardware, which is non-trivial. Even a mid-sized municipal IT team in rybnik running x86 or ARM Linux infrastructure faces zero exposure from this defect; risk prioritization should focus exclusively on operators of MIPS-based embedded Linux platforms such as network routers, industrial controllers, or set-top boxes. The absence of KEV listing, low EPSS, and hard architecture constraint collectively position this as a low real-world priority despite its high CVSS score.

A local user with low-privilege shell access on a MIPS-based Linux system (such as an embedded router or industrial controller) initiates concurrent power-management operations that race on the same pair of regulators, causing ww_mutex_lock() to return -EDEADLK as a backoff signal. The incorrect constant comparison causes the kernel to bypass the unlock-and-retry sequence, emit WARN_ON, and return to the caller holding only one of the two expected locks. The resulting asymmetric locking state opens a window for kernel data-structure corruption that a sophisticated local attacker could leverage for privilege escalation, or that spontaneously triggers a kernel panic.