{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-80750", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.790Z", "datePublished": "2026-09-03T08:26:30.751Z", "dateUpdated": "2026-09-04T04:58:30.299Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-04T04:58:30.299Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: mediatek: fix remaining %pOF after of_node_put()\n\nscpsys_get_bus_protection_legacy() looks up several legacy bus\nprotection regmaps from device-tree nodes.\n\nTwo error paths put the device node before checking whether the regmap\nlookup failed, but still pass that node to dev_err_probe() with %pOF on\nfailure. If of_node_put() drops the last reference, the later %pOF\nformatting can dereference a freed device node.\n\nKeep the node reference until after the error message has been emitted in\nthe infracfg and SMI lookup paths. Also drop the SMI node before\nreturning when the SMI phandle is missing." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - scpsys_probe() runs only via the local platform driver model (boot-time builtin probe, deferred-probe retries); no network, adjacent-network, or physical bus path reaches scpsys_get_bus_protection_legacy(), and exploiting the freed device_node requires local heap interaction in kernel context.\nAC:L - On affected MediaTek SoCs using legacy DT without access-controllers, EPROBE_DEFER from syscon not yet registered deterministically hits the premature of_node_put() error paths during boot probe retries; an attacker with DT overlay can also craft failing regmap lookups at will with no race.\nPR:N - The vulnerable sequence executes automatically during kernel init when the builtin mtk-power-controller platform driver probes on MediaTek phones, Chromebooks, and embedded boards; no credentials, capabilities, or user-namespace privileges are checked on this driver probe path.\nUI:N - Probe and deferred-probe retries run unattended at boot on affected hardware; no administrator action, mount, file open, or other user interaction is required to reach the error path that dereferences the released device_node.\nS:U - The corrupted device_node, its kobject, and OF tree traversal all execute entirely within kernel context on the same security authority; no VM escape, IOMMU boundary bypass, or sandbox crossing occurs.\nC:H - Use-after-free of device_node in dev_err_probe()'s %pOF formatting reads freed heap memory (full_name, compatible strings, phandle, flags) via device_node_string(), enabling kernel pointer leaks and arbitrary memory disclosure per UAF scoring guidance.\nI:H - UAF of device_node permits reclaiming the embedded fwnode_handle/kobject; corrupted ops tables, ktype->release callbacks, and parent/child/sibling links provide exploitable arbitrary write and control-flow hijack primitives consistent with comparable of_node UAF issues.\nA:H - Dereferencing a freed device_node during %pOF formatting can oops or panic the kernel during power-domain probe on affected MediaTek hardware; UAF bugs inherently threaten availability even when not fully weaponized, and failed probe can block power management bring-up." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/pmdomain/mediatek/mtk-pm-domains.c" ], "versions": [ { "version": "c29345fa5f66bea0790cf2219f57b974d4fc177b", "lessThan": "970b9c83a07c405fdd32bcce7cc4c9e670e58875", "status": "affected", "versionType": "git" }, { "version": "c29345fa5f66bea0790cf2219f57b974d4fc177b", "lessThan": "10bf2d7261d7f724ed43a09eea4c90c19c0230a0", "status": "affected", "versionType": "git" }, { "version": "c29345fa5f66bea0790cf2219f57b974d4fc177b", "lessThan": "3e013bc8b941bd52c8e3a99798d0ae8792cb71ca", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/pmdomain/mediatek/mtk-pm-domains.c" ], "versions": [ { "version": "6.18", "status": "affected" }, { "version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.46", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.46" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.1.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/970b9c83a07c405fdd32bcce7cc4c9e670e58875" }, { "url": "https://git.kernel.org/stable/c/10bf2d7261d7f724ed43a09eea4c90c19c0230a0" }, { "url": "https://git.kernel.org/stable/c/3e013bc8b941bd52c8e3a99798d0ae8792cb71ca" } ], "title": "pmdomain: mediatek: fix remaining %pOF after of_node_put()", "x_generator": { "engine": "bippy-1.2.0" } } } }