CVE-2026-80750

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_bus_protection_legacy() looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap lookup failed, but still pass that node to dev_err_probe() with %pOF on failure. If of_node_put() drops the last reference, the later %pOF formatting can dereference a freed device node. Keep the node reference until after the error message has been emitted in the infracfg and SMI lookup paths. Also drop the SMI node before returning when the SMI phandle is missing.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/10bf2d7261d7f724ed43a09eea4c90c19c0230a0
https://git.kernel.org/stable/c/3e013bc8b941bd52c8e3a99798d0ae8792cb71ca
https://git.kernel.org/stable/c/970b9c83a07c405fdd32bcce7cc4c9e670e58875

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-03 13:06

Updated : 2026-09-04 05:17

NVD link : CVE-2026-80750

Mitre link : CVE-2026-80750

CVE.ORG link : CVE-2026-80750

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-80750", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c29345fa5f66bea0790cf2219f57b974d4fc177b", "lessThan": "970b9c83a07c405fdd32bcce7cc4c9e670e58875", "versionType": "git"}, {"status": "affected", "version": "c29345fa5f66bea0790cf2219f57b974d4fc177b", "lessThan": "10bf2d7261d7f724ed43a09eea4c90c19c0230a0", "versionType": "git"}, {"status": "affected", "version": "c29345fa5f66bea0790cf2219f57b974d4fc177b", "lessThan": "3e013bc8b941bd52c8e3a99798d0ae8792cb71ca", "versionType": "git"}], "programFiles": ["drivers/pmdomain/mediatek/mtk-pm-domains.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"status": "unaffected", "version": "0", "lessThan": "6.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.46", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.10", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/pmdomain/mediatek/mtk-pm-domains.c"], "defaultStatus": "affected"}]}], "published": "2026-09-03T13:06:14.650", "references": [{"url": "https://git.kernel.org/stable/c/10bf2d7261d7f724ed43a09eea4c90c19c0230a0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3e013bc8b941bd52c8e3a99798d0ae8792cb71ca", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/970b9c83a07c405fdd32bcce7cc4c9e670e58875", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: mediatek: fix remaining %pOF after of_node_put()\n\nscpsys_get_bus_protection_legacy() looks up several legacy bus\nprotection regmaps from device-tree nodes.\n\nTwo error paths put the device node before checking whether the regmap\nlookup failed, but still pass that node to dev_err_probe() with %pOF on\nfailure. If of_node_put() drops the last reference, the later %pOF\nformatting can dereference a freed device node.\n\nKeep the node reference until after the error message has been emitted in\nthe infracfg and SMI lookup paths. Also drop the SMI node before\nreturning when the SMI phandle is missing."}], "lastModified": "2026-09-04T05:17:14.993", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}