{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:25:43.286538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:33:12.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/mediatek/mtk_drm_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d",
              "status": "affected",
              "version": "7d98166183d627c0b9daca7672b2191fae0f8a03",
              "versionType": "git"
            },
            {
              "lessThan": "b58a26cdd4795c1ce6a80e38e9348885555dacd6",
              "status": "affected",
              "version": "31ce7c089b50c3d3056c37e0e25e7535e4428ae1",
              "versionType": "git"
            },
            {
              "lessThan": "c4901802ed1ce859242e10af06e6a7752cba0497",
              "status": "affected",
              "version": "fae58d0155a979a8c414bbc12db09dd4b2f910d0",
              "versionType": "git"
            },
            {
              "lessThan": "4de37a48b6b58faaded9eb765047cf0d8785ea18",
              "status": "affected",
              "version": "1f403699c40f0806a707a9a6eed3b8904224021a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/mediatek/mtk_drm_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.6.107",
              "status": "affected",
              "version": "6.6.105",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.48",
              "status": "affected",
              "version": "6.12.45",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16.8",
              "status": "affected",
              "version": "6.16.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.107",
                  "versionStartIncluding": "6.6.105",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "6.12.45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.8",
                  "versionStartIncluding": "6.16.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: fix potential OF node use-after-free\n\nThe for_each_child_of_node() helper drops the reference it takes to each\nnode as it iterates over children and an explicit of_node_put() is only\nneeded when exiting the loop early.\n\nDrop the recently introduced bogus additional reference count decrement\nat each iteration that could potentially lead to a use-after-free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - `mtk_drm_get_all_drm_priv()` is reached only through the local driver model \u2014 boot-time component bind from `mtk_drm_probe()`/`component_master_add_with_match()`, deferred-probe retries, sysfs bind/unbind of `mediatek-drm`, or module load/unload; there is no network, adjacent-network, or physical path, and leveraging the released `device_node` requires a local heap spray in the same kmalloc cache.\nAC:L - The extra `of_node_put()` at the `next_put_node:` label is unconditional \u2014 every path in the loop body falls through to it, so all 221 `/soc` children lose a reference on every single call, with no race to win and no memory-layout precondition. On mt8195/mt8188 (`mmsys_dev_num == 2`) the loop runs at least twice per boot, and bind/unbind cycles reproduce it deterministically at will.\nPR:N - No credential, capability, or namespace check exists anywhere on the path \u2014 the references are dropped by the kernel\u0027s own component-bind machinery at boot, before any user session exists, so the underflowed/released `device_node` state is reached with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not required for the vulnerable condition to arise (same basis as CVE-2025-39930 for this identical bug class).\nUI:N - The MediaTek DRM component master binds automatically once its device-tree components probe, and deferred-probe retries run unattended at boot; no administrator, victim action, mount, or file open is needed for the extra `of_node_put()` to fire.\nS:U - The corrupted `struct device_node`, its embedded kobject, and the OF tree all belong to the kernel\u0027s own security authority, and the faulting code executes in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a premature release/use-after-free of `device_node` objects that remain reachable through the OF tree, `dev-\u003eof_node`, and phandle lookups; `kobject_cleanup()` `kfree_const()`s `kobj-\u003ename` while leaving the pointer live, and once the slab is reclaimed `of_property_read_*()`, `%pOF` on `full_name`, and `kobject_name()` read back attacker-sprayed heap contents \u2014 while the `bad of_node_put()` splat plus `dump_stack()` already leaks kernel pointers and a full stack trace.\nI:H - A reclaimed `device_node` yields a control-flow hijack primitive via the embedded `fwnode_handle.ops` table dereferenced by `fwnode_call_int_op()` and via `kobj.ktype-\u003erelease` invoked on the next `of_node_put()`, and the `parent`/`child`/`sibling` links plus device-link `suppliers`/`consumers` list heads give arbitrary-write through list manipulation during tree operations.\nA:H - Each boot produces \"ERROR: detected bad of_node_put()\" with `dump_stack()` followed by `refcount_t: underflow; use-after-free` WARNs \u2014 an outright panic under `panic_on_warn` \u2014 while `__kobject_del()` tears down `/sys/firmware/devicetree/base` entries and cascades puts onto the `/soc` node, and dereferencing a released node oopses the kernel with display bring-up failing outright."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:53.126Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b58a26cdd4795c1ce6a80e38e9348885555dacd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4901802ed1ce859242e10af06e6a7752cba0497"
        },
        {
          "url": "https://git.kernel.org/stable/c/4de37a48b6b58faaded9eb765047cf0d8785ea18"
        }
      ],
      "title": "drm/mediatek: fix potential OF node use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39882",
    "datePublished": "2025-09-23T06:00:51.036Z",
    "dateReserved": "2025-04-16T07:20:57.144Z",
    "dateUpdated": "2026-08-05T12:05:53.126Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}