CVE-2026-80750 in Linux
Summary
by MITRE • 09/03/2026
In the Linux kernel, the following vulnerability has been resolved:
pmdomain: mediatek: fix remaining %pOF after of_node_put()
scpsys_get_bus_protection_legacy() looks up several legacy bus protection regmaps from device-tree nodes.
Two error paths put the device node before checking whether the regmap lookup failed, but still pass that node to dev_err_probe() with %pOF on failure. If of_node_put() drops the last reference, the later %pOF formatting can dereference a freed device node.
Keep the node reference until after the error message has been emitted in the infracfg and SMI lookup paths. Also drop the SMI node before returning when the SMI phandle is missing.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The identified vulnerability resides within the Linux kernel's power domain subsystem, specifically affecting the MediaTek System Power Controller (SCPSYS) driver. This issue manifests as a use-after-free condition triggered by improper reference counting management during device tree node processing. The core of the problem lies in the scpsys_get_bus_protection_legacy function, which is responsible for retrieving legacy bus protection register maps from device-tree nodes. In this process, the code performs lookups for specific hardware configurations and handles potential errors that may arise if these resources are unavailable or malformed.
The technical flaw involves a race condition between reference counting and pointer usage in two distinct error paths within the infracfg and SMI lookup sequences. When an error occurs during the regmap lookup, the original implementation incorrectly decrements the device node's reference count by calling of_node_put before verifying whether the subsequent operations succeeded or failed. Specifically, if the refcount drops to zero due to this premature release, the kernel frees the underlying memory associated with that device tree node. However, the code subsequently attempts to log an error message using dev_err_probe with a format specifier %pOF, which requires dereferencing the now-freed pointer to extract and display information about the offending node. This sequence results in accessing invalid memory, leading to potential kernel panics or undefined behavior depending on how quickly that memory is reused by other subsystems.
This vulnerability aligns with CWE-416, Use After Free, as it involves referencing a previously freed memory location. From an offensive security perspective, such bugs can be leveraged for privilege escalation if the attacker can influence the allocation patterns to overwrite critical kernel structures in the reclaimed memory space, although exploitation typically requires specific timing and context within the kernel's memory allocator. The ATT&CK framework categorizes this type of flaw under techniques related to exploiting software vulnerabilities during initial access or persistence phases, particularly where local code execution leads to higher privileges via kernel exploits.
The operational impact of this vulnerability is significant for system stability and security integrity. A successful exploitation could cause a denial of service through a kernel crash, disrupting all services running on the affected device. Furthermore, in environments where hardware abstraction layers are critical, such as embedded systems or IoT devices utilizing MediaTek SoCs, instability in power management can lead to unpredictable hardware states, potentially causing data corruption or permanent damage if power rails are not managed correctly during a fault condition. For enterprise deployments relying on these kernels for reliability guarantees, this represents a serious compliance and operational risk that must be addressed promptly.
Mitigation strategies primarily involve applying the upstream kernel patch that corrects the reference counting logic. The fix ensures that device node references are retained until after error messages have been safely emitted, thereby preventing premature deallocation of memory still required for logging purposes. Additionally, the corrected code properly drops the SMI node reference only when it is confirmed to be missing or irrelevant, maintaining strict adherence to kernel resource management protocols. Administrators should update their systems to include this patch and verify that no custom modifications override these safety checks in downstream distributions. Regular auditing of device tree handling code for similar patterns can help prevent recurrence of such issues across other drivers within the ecosystem.