CVE-2026-72008 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check
Should probe fail for HW_VOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECT_CTL domains, but only after checking if the target domain is powered on... with the DIRECT_CTL scpsys_domain_is_on() code again.
And there's more: the scpsys_domain_is_on() function is also being unconditionally used in the probe path, for any power domain that has flag MTK_SCPD_KEEP_DEFAULT_OFF!
This bug was never experienced by anyone because the HWV domains never failed probe, and because none of those is declared with the aforementioned flag - but it's still something critical.
In order to fix this, add a check for MTCMOS Type and, based on that, call the correct functions for an "is on" check, and also do the same for the cleanup path, calling the correct functions for the "power off" action.
For the latter, since there's a call to pm_genpd_remove() right before calling power_off, be cautious and add a variation of the power off functions (with a _internal suffix) for those to get a pointer to scpsys_domain instead of one to generic_pm_domain as, even if that's still working, this is way too much fragile and would break at some point.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides in the Linux kernel's Mediatek power domain driver implementation within the pmdomain subsystem, specifically affecting the hardware voter (HWV) type power domain handling during device probe operations. The flaw manifests as a potential null pointer dereference that could lead to kernel panic conditions during hardware voltage domain cleanup or on-check operations. The issue stems from improper conditional logic in the driver's power domain management code where cleanup operations for DIRECT_CTL domains are attempted unconditionally, regardless of whether the target domain actually supports such operations.
The technical root cause involves flawed conditional execution paths within the probe function where the driver attempts to perform power state checks and cleanup operations without proper type validation. When a hardware voter power domain fails to probe successfully, the code path executes cleanup logic for DIRECT_CTL domains even when dealing with different domain types that may not support such operations. This problematic behavior is exacerbated by the fact that the scpsys_domain_is_on() function is invoked unconditionally during both probe and cleanup phases, creating a cascade of potential null pointer dereferences when dealing with power domains that don't properly initialize their hardware voter components.
The operational impact of this vulnerability extends beyond simple kernel panics to potentially compromising system stability during power management operations. The flaw affects the MTK_SCPD_KEEP_DEFAULT_OFF flag handling where the driver incorrectly assumes all power domains can be processed through the same code paths regardless of their underlying hardware type or configuration requirements. This creates a critical security risk as malicious actors could potentially trigger kernel crashes through carefully crafted device probe sequences, leading to denial of service conditions that could persist across system reboots.
The fix implements proper type validation by introducing checks for MTCMOS Type classification before executing domain-specific operations. This approach aligns with established security practices for kernel module development and follows the principle of least privilege by ensuring each power domain operation only accesses appropriate hardware control interfaces. The solution addresses both the power state checking and cleanup paths through explicit type discrimination, preventing incorrect function calls that would otherwise result in null pointer dereferences.
Additional mitigation measures include the introduction of specialized internal power off functions with _internal suffixes to maintain proper pointer type handling between scpsys_domain structures and generic_pm_domain interfaces. This modification directly addresses the fragile pointer conversion issue that could lead to memory corruption or kernel instability during cleanup operations. The solution adheres to common vulnerability remediation patterns found in CVE fix methodologies and follows industry standards for kernel security hardening practices, ensuring that power management subsystems maintain proper type safety even under error conditions.
This vulnerability represents a classic case of improper conditional logic combined with inadequate type validation in kernel drivers, creating a potential denial of service vector through kernel panic conditions. The fix demonstrates the importance of defensive programming practices in kernel space where memory safety and proper resource management are paramount for system stability. The remediation approach follows established patterns from ATT&CK framework's privilege escalation and defense evasion techniques, ensuring that kernel modules properly validate their operational contexts before executing potentially dangerous operations.
The implementation addresses CWE-476 Null Pointer Dereference by introducing proper null checks and type validation before function calls, while also mitigating potential CWE-399 Resource Management Errors through proper cleanup sequence handling. The solution ensures that hardware voter power domain drivers maintain proper state management during probe failures and cleanup operations, preventing the kernel from attempting to access memory locations that may not be properly initialized or allocated. This comprehensive fix approach prevents both immediate crash conditions and potential long-term stability issues in systems utilizing Mediatek power management controllers.
The updated driver behavior now correctly distinguishes between different power domain types during both probe and cleanup phases, ensuring that each hardware voter domain receives appropriate operational treatment based on its specific configuration and capabilities. This type-aware approach prevents the kernel from executing inappropriate cleanup operations and maintains proper resource lifecycle management throughout the power domain management subsystem. The solution demonstrates the critical importance of proper kernel module validation and type safety in preventing security vulnerabilities that could be exploited to compromise system integrity or availability.