CVE-2026-80750 (GCVE-0-2026-80750)
Vulnerability from cvelistv5 – Published: 2026-09-03 08:26 – Updated: 2026-09-04 04:58
VLAI
EPSS
VEX
Title
pmdomain: mediatek: fix remaining %pOF after of_node_put()
Summary
In the Linux kernel, the following vulnerability has been resolved:
pmdomain: mediatek: fix remaining %pOF after of_node_put()
scpsys_get_bus_protection_legacy() looks up several legacy bus
protection regmaps from device-tree nodes.
Two error paths put the device node before checking whether the regmap
lookup failed, but still pass that node to dev_err_probe() with %pOF on
failure. If of_node_put() drops the last reference, the later %pOF
formatting can dereference a freed device node.
Keep the node reference until after the error message has been emitted in
the infracfg and SMI lookup paths. Also drop the SMI node before
returning when the SMI phandle is missing.
Severity
8.4 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
c29345fa5f66bea0790cf2219f57b974d4fc177b , < 970b9c83a07c405fdd32bcce7cc4c9e670e58875
(git)
Affected: c29345fa5f66bea0790cf2219f57b974d4fc177b , < 10bf2d7261d7f724ed43a09eea4c90c19c0230a0 (git) Affected: c29345fa5f66bea0790cf2219f57b974d4fc177b , < 3e013bc8b941bd52c8e3a99798d0ae8792cb71ca (git) |
guessed | |
| Linux | Linux |
Affected:
6.18
Unaffected: 0 , < 6.18 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pmdomain/mediatek/mtk-pm-domains.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "970b9c83a07c405fdd32bcce7cc4c9e670e58875",
"status": "affected",
"version": "c29345fa5f66bea0790cf2219f57b974d4fc177b",
"versionType": "git"
},
{
"lessThan": "10bf2d7261d7f724ed43a09eea4c90c19c0230a0",
"status": "affected",
"version": "c29345fa5f66bea0790cf2219f57b974d4fc177b",
"versionType": "git"
},
{
"lessThan": "3e013bc8b941bd52c8e3a99798d0ae8792cb71ca",
"status": "affected",
"version": "c29345fa5f66bea0790cf2219f57b974d4fc177b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pmdomain/mediatek/mtk-pm-domains.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: mediatek: fix remaining %pOF after of_node_put()\n\nscpsys_get_bus_protection_legacy() looks up several legacy bus\nprotection regmaps from device-tree nodes.\n\nTwo error paths put the device node before checking whether the regmap\nlookup failed, but still pass that node to dev_err_probe() with %pOF on\nfailure. If of_node_put() drops the last reference, the later %pOF\nformatting can dereference a freed device node.\n\nKeep the node reference until after the error message has been emitted in\nthe infracfg and SMI lookup paths. Also drop the SMI node before\nreturning when the SMI phandle is missing."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - scpsys_probe() runs only via the local platform driver model (boot-time builtin probe, deferred-probe retries); no network, adjacent-network, or physical bus path reaches scpsys_get_bus_protection_legacy(), and exploiting the freed device_node requires local heap interaction in kernel context.\nAC:L - On affected MediaTek SoCs using legacy DT without access-controllers, EPROBE_DEFER from syscon not yet registered deterministically hits the premature of_node_put() error paths during boot probe retries; an attacker with DT overlay can also craft failing regmap lookups at will with no race.\nPR:N - The vulnerable sequence executes automatically during kernel init when the builtin mtk-power-controller platform driver probes on MediaTek phones, Chromebooks, and embedded boards; no credentials, capabilities, or user-namespace privileges are checked on this driver probe path.\nUI:N - Probe and deferred-probe retries run unattended at boot on affected hardware; no administrator action, mount, file open, or other user interaction is required to reach the error path that dereferences the released device_node.\nS:U - The corrupted device_node, its kobject, and OF tree traversal all execute entirely within kernel context on the same security authority; no VM escape, IOMMU boundary bypass, or sandbox crossing occurs.\nC:H - Use-after-free of device_node in dev_err_probe()\u0027s %pOF formatting reads freed heap memory (full_name, compatible strings, phandle, flags) via device_node_string(), enabling kernel pointer leaks and arbitrary memory disclosure per UAF scoring guidance.\nI:H - UAF of device_node permits reclaiming the embedded fwnode_handle/kobject; corrupted ops tables, ktype-\u003erelease callbacks, and parent/child/sibling links provide exploitable arbitrary write and control-flow hijack primitives consistent with comparable of_node UAF issues.\nA:H - Dereferencing a freed device_node during %pOF formatting can oops or panic the kernel during power-domain probe on affected MediaTek hardware; UAF bugs inherently threaten availability even when not fully weaponized, and failed probe can block power management bring-up."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T04:58:30.299Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/970b9c83a07c405fdd32bcce7cc4c9e670e58875"
},
{
"url": "https://git.kernel.org/stable/c/10bf2d7261d7f724ed43a09eea4c90c19c0230a0"
},
{
"url": "https://git.kernel.org/stable/c/3e013bc8b941bd52c8e3a99798d0ae8792cb71ca"
}
],
"title": "pmdomain: mediatek: fix remaining %pOF after of_node_put()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80750",
"datePublished": "2026-09-03T08:26:30.751Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-09-04T04:58:30.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-80750",
"date": "2026-09-03",
"epss": "0.00198",
"percentile": "0.09565"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-80750\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-03T13:06:14.650\",\"lastModified\":\"2026-09-04T05:17:14.993\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npmdomain: mediatek: fix remaining %pOF after of_node_put()\\n\\nscpsys_get_bus_protection_legacy() looks up several legacy bus\\nprotection regmaps from device-tree nodes.\\n\\nTwo error paths put the device node before checking whether the regmap\\nlookup failed, but still pass that node to dev_err_probe() with %pOF on\\nfailure. If of_node_put() drops the last reference, the later %pOF\\nformatting can dereference a freed device node.\\n\\nKeep the node reference until after the error message has been emitted in\\nthe infracfg and SMI lookup paths. Also drop the SMI node before\\nreturning when the SMI phandle is missing.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/pmdomain/mediatek/mtk-pm-domains.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c29345fa5f66bea0790cf2219f57b974d4fc177b\",\"lessThan\":\"970b9c83a07c405fdd32bcce7cc4c9e670e58875\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c29345fa5f66bea0790cf2219f57b974d4fc177b\",\"lessThan\":\"10bf2d7261d7f724ed43a09eea4c90c19c0230a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c29345fa5f66bea0790cf2219f57b974d4fc177b\",\"lessThan\":\"3e013bc8b941bd52c8e3a99798d0ae8792cb71ca\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/pmdomain/mediatek/mtk-pm-domains.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/10bf2d7261d7f724ed43a09eea4c90c19c0230a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3e013bc8b941bd52c8e3a99798d0ae8792cb71ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/970b9c83a07c405fdd32bcce7cc4c9e670e58875\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-03T16:24:54Z",
"cve": "CVE-2026-80750",
"id": "CVE-2026-80750",
"initial_release_date": "2026-09-03T16:24:54Z",
"product_status:known_not_affected": "353",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-80750",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80750.json",
"version": "2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…