GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-39882 (GCVE-0-2025-39882)

Vulnerability from cvelistv5 – Published: 2025-09-23 06:00 – Updated: 2026-08-05 12:05
VLAI
Title
drm/mediatek: fix potential OF node use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: fix potential OF node use-after-free The for_each_child_of_node() helper drops the reference it takes to each node as it iterates over children and an explicit of_node_put() is only needed when exiting the loop early. Drop the recently introduced bogus additional reference count decrement at each iteration that could potentially lead to a use-after-free.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 19:25 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7d98166183d627c0b9daca7672b2191fae0f8a03 , < b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d (git)
Affected: 31ce7c089b50c3d3056c37e0e25e7535e4428ae1 , < b58a26cdd4795c1ce6a80e38e9348885555dacd6 (git)
Affected: fae58d0155a979a8c414bbc12db09dd4b2f910d0 , < c4901802ed1ce859242e10af06e6a7752cba0497 (git)
Affected: 1f403699c40f0806a707a9a6eed3b8904224021a , < 4de37a48b6b58faaded9eb765047cf0d8785ea18 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6.105 , < 6.6.107 (semver)
Affected: 6.12.45 , < 6.12.48 (semver)
Affected: 6.16.5 , < 6.16.8 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:25:43.286538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:33:12.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/mediatek/mtk_drm_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d",
              "status": "affected",
              "version": "7d98166183d627c0b9daca7672b2191fae0f8a03",
              "versionType": "git"
            },
            {
              "lessThan": "b58a26cdd4795c1ce6a80e38e9348885555dacd6",
              "status": "affected",
              "version": "31ce7c089b50c3d3056c37e0e25e7535e4428ae1",
              "versionType": "git"
            },
            {
              "lessThan": "c4901802ed1ce859242e10af06e6a7752cba0497",
              "status": "affected",
              "version": "fae58d0155a979a8c414bbc12db09dd4b2f910d0",
              "versionType": "git"
            },
            {
              "lessThan": "4de37a48b6b58faaded9eb765047cf0d8785ea18",
              "status": "affected",
              "version": "1f403699c40f0806a707a9a6eed3b8904224021a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/mediatek/mtk_drm_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.6.107",
              "status": "affected",
              "version": "6.6.105",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.48",
              "status": "affected",
              "version": "6.12.45",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16.8",
              "status": "affected",
              "version": "6.16.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.107",
                  "versionStartIncluding": "6.6.105",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "6.12.45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.8",
                  "versionStartIncluding": "6.16.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: fix potential OF node use-after-free\n\nThe for_each_child_of_node() helper drops the reference it takes to each\nnode as it iterates over children and an explicit of_node_put() is only\nneeded when exiting the loop early.\n\nDrop the recently introduced bogus additional reference count decrement\nat each iteration that could potentially lead to a use-after-free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - `mtk_drm_get_all_drm_priv()` is reached only through the local driver model \u2014 boot-time component bind from `mtk_drm_probe()`/`component_master_add_with_match()`, deferred-probe retries, sysfs bind/unbind of `mediatek-drm`, or module load/unload; there is no network, adjacent-network, or physical path, and leveraging the released `device_node` requires a local heap spray in the same kmalloc cache.\nAC:L - The extra `of_node_put()` at the `next_put_node:` label is unconditional \u2014 every path in the loop body falls through to it, so all 221 `/soc` children lose a reference on every single call, with no race to win and no memory-layout precondition. On mt8195/mt8188 (`mmsys_dev_num == 2`) the loop runs at least twice per boot, and bind/unbind cycles reproduce it deterministically at will.\nPR:N - No credential, capability, or namespace check exists anywhere on the path \u2014 the references are dropped by the kernel\u0027s own component-bind machinery at boot, before any user session exists, so the underflowed/released `device_node` state is reached with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not required for the vulnerable condition to arise (same basis as CVE-2025-39930 for this identical bug class).\nUI:N - The MediaTek DRM component master binds automatically once its device-tree components probe, and deferred-probe retries run unattended at boot; no administrator, victim action, mount, or file open is needed for the extra `of_node_put()` to fire.\nS:U - The corrupted `struct device_node`, its embedded kobject, and the OF tree all belong to the kernel\u0027s own security authority, and the faulting code executes in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a premature release/use-after-free of `device_node` objects that remain reachable through the OF tree, `dev-\u003eof_node`, and phandle lookups; `kobject_cleanup()` `kfree_const()`s `kobj-\u003ename` while leaving the pointer live, and once the slab is reclaimed `of_property_read_*()`, `%pOF` on `full_name`, and `kobject_name()` read back attacker-sprayed heap contents \u2014 while the `bad of_node_put()` splat plus `dump_stack()` already leaks kernel pointers and a full stack trace.\nI:H - A reclaimed `device_node` yields a control-flow hijack primitive via the embedded `fwnode_handle.ops` table dereferenced by `fwnode_call_int_op()` and via `kobj.ktype-\u003erelease` invoked on the next `of_node_put()`, and the `parent`/`child`/`sibling` links plus device-link `suppliers`/`consumers` list heads give arbitrary-write through list manipulation during tree operations.\nA:H - Each boot produces \"ERROR: detected bad of_node_put()\" with `dump_stack()` followed by `refcount_t: underflow; use-after-free` WARNs \u2014 an outright panic under `panic_on_warn` \u2014 while `__kobject_del()` tears down `/sys/firmware/devicetree/base` entries and cascades puts onto the `/soc` node, and dereferencing a released node oopses the kernel with display bring-up failing outright."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:53.126Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b58a26cdd4795c1ce6a80e38e9348885555dacd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4901802ed1ce859242e10af06e6a7752cba0497"
        },
        {
          "url": "https://git.kernel.org/stable/c/4de37a48b6b58faaded9eb765047cf0d8785ea18"
        }
      ],
      "title": "drm/mediatek: fix potential OF node use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39882",
    "datePublished": "2025-09-23T06:00:51.036Z",
    "dateReserved": "2025-04-16T07:20:57.144Z",
    "dateUpdated": "2026-08-05T12:05:53.126Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39882",
      "date": "2026-09-16",
      "epss": "0.00152",
      "percentile": "0.04683"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39882\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-23T06:15:47.947\",\"lastModified\":\"2026-07-30T06:23:53.717\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/mediatek: fix potential OF node use-after-free\\n\\nThe for_each_child_of_node() helper drops the reference it takes to each\\nnode as it iterates over children and an explicit of_node_put() is only\\nneeded when exiting the loop early.\\n\\nDrop the recently introduced bogus additional reference count decrement\\nat each iteration that could potentially lead to a use-after-free.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/mediatek/mtk_drm_drv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7d98166183d627c0b9daca7672b2191fae0f8a03\",\"lessThan\":\"b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"31ce7c089b50c3d3056c37e0e25e7535e4428ae1\",\"lessThan\":\"b58a26cdd4795c1ce6a80e38e9348885555dacd6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fae58d0155a979a8c414bbc12db09dd4b2f910d0\",\"lessThan\":\"c4901802ed1ce859242e10af06e6a7752cba0497\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1f403699c40f0806a707a9a6eed3b8904224021a\",\"lessThan\":\"4de37a48b6b58faaded9eb765047cf0d8785ea18\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/mediatek/mtk_drm_drv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6.105\",\"lessThan\":\"6.6.107\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.45\",\"lessThan\":\"6.12.48\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.16.5\",\"lessThan\":\"6.16.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T19:25:43.286538Z\",\"id\":\"CVE-2025-39882\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.105\",\"versionEndExcluding\":\"6.6.107\",\"matchCriteriaId\":\"C7059167-0B11-467C-9F6D-8222BB30F40A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.45\",\"versionEndExcluding\":\"6.12.48\",\"matchCriteriaId\":\"4834C96E-5049-4D95-B247-49C037F71647\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16.5\",\"versionEndExcluding\":\"6.16.8\",\"matchCriteriaId\":\"EEAC17D4-932B-4C5C-A1F8-E6FB83B9580F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"340BEEA9-D70D-4290-B502-FBB1032353B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"47E4C5C0-079F-4838-971B-8C503D48FCC2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4de37a48b6b58faaded9eb765047cf0d8785ea18\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b58a26cdd4795c1ce6a80e38e9348885555dacd6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c4901802ed1ce859242e10af06e6a7752cba0497\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:14:09+00:00",
      "cve": "CVE-2025-39882",
      "id": "CVE-2025-39882",
      "initial_release_date": "2025-09-23T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/mediatek: fix potential OF node use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39882.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:16:37Z",
      "cve": "CVE-2025-39882",
      "id": "CVE-2025-39882",
      "initial_release_date": "2025-09-24T23:22:40Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "387",
      "product_status:recommended": "464",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39882",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39882.json",
      "version": "48"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-39882\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T19:25:43.286538Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T19:25:37.870Z\"}}], \"cna\": {\"title\": \"drm/mediatek: fix potential OF node use-after-free\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.4, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - `mtk_drm_get_all_drm_priv()` is reached only through the local driver model \\u2014 boot-time component bind from `mtk_drm_probe()`/`component_master_add_with_match()`, deferred-probe retries, sysfs bind/unbind of `mediatek-drm`, or module load/unload; there is no network, adjacent-network, or physical path, and leveraging the released `device_node` requires a local heap spray in the same kmalloc cache.\\nAC:L - The extra `of_node_put()` at the `next_put_node:` label is unconditional \\u2014 every path in the loop body falls through to it, so all 221 `/soc` children lose a reference on every single call, with no race to win and no memory-layout precondition. On mt8195/mt8188 (`mmsys_dev_num == 2`) the loop runs at least twice per boot, and bind/unbind cycles reproduce it deterministically at will.\\nPR:N - No credential, capability, or namespace check exists anywhere on the path \\u2014 the references are dropped by the kernel\u0027s own component-bind machinery at boot, before any user session exists, so the underflowed/released `device_node` state is reached with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not required for the vulnerable condition to arise (same basis as CVE-2025-39930 for this identical bug class).\\nUI:N - The MediaTek DRM component master binds automatically once its device-tree components probe, and deferred-probe retries run unattended at boot; no administrator, victim action, mount, or file open is needed for the extra `of_node_put()` to fire.\\nS:U - The corrupted `struct device_node`, its embedded kobject, and the OF tree all belong to the kernel\u0027s own security authority, and the faulting code executes in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.\\nC:H - This is a premature release/use-after-free of `device_node` objects that remain reachable through the OF tree, `dev-\u003eof_node`, and phandle lookups; `kobject_cleanup()` `kfree_const()`s `kobj-\u003ename` while leaving the pointer live, and once the slab is reclaimed `of_property_read_*()`, `%pOF` on `full_name`, and `kobject_name()` read back attacker-sprayed heap contents \\u2014 while the `bad of_node_put()` splat plus `dump_stack()` already leaks kernel pointers and a full stack trace.\\nI:H - A reclaimed `device_node` yields a control-flow hijack primitive via the embedded `fwnode_handle.ops` table dereferenced by `fwnode_call_int_op()` and via `kobj.ktype-\u003erelease` invoked on the next `of_node_put()`, and the `parent`/`child`/`sibling` links plus device-link `suppliers`/`consumers` list heads give arbitrary-write through list manipulation during tree operations.\\nA:H - Each boot produces \\\"ERROR: detected bad of_node_put()\\\" with `dump_stack()` followed by `refcount_t: underflow; use-after-free` WARNs \\u2014 an outright panic under `panic_on_warn` \\u2014 while `__kobject_del()` tears down `/sys/firmware/devicetree/base` entries and cascades puts onto the `/soc` node, and dereferencing a released node oopses the kernel with display bring-up failing outright.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7d98166183d627c0b9daca7672b2191fae0f8a03\", \"lessThan\": \"b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"31ce7c089b50c3d3056c37e0e25e7535e4428ae1\", \"lessThan\": \"b58a26cdd4795c1ce6a80e38e9348885555dacd6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fae58d0155a979a8c414bbc12db09dd4b2f910d0\", \"lessThan\": \"c4901802ed1ce859242e10af06e6a7752cba0497\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1f403699c40f0806a707a9a6eed3b8904224021a\", \"lessThan\": \"4de37a48b6b58faaded9eb765047cf0d8785ea18\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/mediatek/mtk_drm_drv.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6.105\", \"lessThan\": \"6.6.107\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.12.45\", \"lessThan\": \"6.12.48\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.16.5\", \"lessThan\": \"6.16.8\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/gpu/drm/mediatek/mtk_drm_drv.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d\"}, {\"url\": \"https://git.kernel.org/stable/c/b58a26cdd4795c1ce6a80e38e9348885555dacd6\"}, {\"url\": \"https://git.kernel.org/stable/c/c4901802ed1ce859242e10af06e6a7752cba0497\"}, {\"url\": \"https://git.kernel.org/stable/c/4de37a48b6b58faaded9eb765047cf0d8785ea18\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/mediatek: fix potential OF node use-after-free\\n\\nThe for_each_child_of_node() helper drops the reference it takes to each\\nnode as it iterates over children and an explicit of_node_put() is only\\nneeded when exiting the loop early.\\n\\nDrop the recently introduced bogus additional reference count decrement\\nat each iteration that could potentially lead to a use-after-free.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.107\", \"versionStartIncluding\": \"6.6.105\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.48\", \"versionStartIncluding\": \"6.12.45\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.8\", \"versionStartIncluding\": \"6.16.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:05:53.126Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-39882\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T12:05:53.126Z\", \"dateReserved\": \"2025-04-16T07:20:57.144Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-23T06:00:51.036Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.