CVE-2026-64252: MIPS: DEC: Prevent initial console buffer from landing in XKPHYS

highCVSS 8.4CVE-2026-64252

CSIRTS triage

What: An issue prevents the initial console buffer from landing in XKPHYS.
Who is affected: Deployments using MIPS DEC may be affected.
Urgency: Remediation urgency is unclear due to unknown severity and exploitation status.
Action: Monitor for updates regarding this issue.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: high — CVSS 8.4
Published: 2026-07-14
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64252

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-642520.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-64252	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

medium[NEW] [medium] Linux Kernel: Multiple vulnerabilitiescert-bund
unknownMultiples vulnérabilités dans le noyau Linux de Debian LTS (31 juillet 2026)cert-fr-avis
unknownCVE-2026-64252: In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Prevent initial…nvd

Recent advisories for MIPS

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-64252: In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Prevent initial…nvd · 2026-07-24
unknownCVE-2026-64250: In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CP…nvd · 2026-07-24
unknownCVE-2026-64248: In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CP…nvd · 2026-07-24
mediumCVE-2026-64248: MIPS: smp: report dying CPU to RCU in stop_this_cpu()msrc · 2026-07-14
mediumCVE-2026-46250: MIPS: Work around LLVM bug when gp is used as global register variablemsrc · 2026-06-09