Linux Kernel up to 7.1.4/7.2-rc3 pmdomain scpsys_domain_is_on null pointer dereference

Summaryinfo

A vulnerability categorized as critical has been discovered in Linux Kernel up to 7.1.4/7.2-rc3. Affected by this vulnerability is the function scpsys_domain_is_on of the component pmdomain. Executing a manipulation can lead to null pointer dereference. This vulnerability is tracked as CVE-2026-72008. The attack is restricted to local execution. No exploit exists.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel up to 7.1.4/7.2-rc3. This vulnerability affects the function scpsys_domain_is_on of the component pmdomain. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HW_VOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECT_CTL domains, but only after checking if the target domain is powered on... with the DIRECT_CTL scpsys_domain_is_on() code again. And there's more: the scpsys_domain_is_on() function is also being unconditionally used in the probe path, for any power domain that has flag MTK_SCPD_KEEP_DEFAULT_OFF! This bug was never experienced by anyone because the HWV domains never failed probe, and because none of those is declared with the aforementioned flag - but it's still something critical. In order to fix this, add a check for MTCMOS Type and, based on that, call the correct functions for an "is on" check, and also do the same for the cleanup path, calling the correct functions for the "power off" action. For the latter, since there's a call to pm_genpd_remove() right before calling power_off, be cautious and add a variation of the power off functions (with a _internal suffix) for those to get a pointer to scpsys_domain instead of one to generic_pm_domain as, even if that's still working, this is way too much fragile and would break at some point.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-72008 since 08/09/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 7.1.5 or 7.2-rc4 eliminates this vulnerability. Applying the patch 36c2d7728540252474752172027f0113028ab00c/a4876f11aa1d076802676e23f8af500706e780e3 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.2-rc1
• 7.2-rc2
• 7.2-rc3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion