HIGH Introduced in 6.19
pmdomain mfg Deref
CVE-2026-80751
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.1MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtk_mfg_attach_dev() reads prev_o on the first iteration of its loop, in "if (prev_o && prev_o->freq == o->freq)", before prev_o is assigned at the end of the loop body. On that first iteration, evaluating prev_o reads an indeterminate value. If it is non-NULL, the condition dereferences a stale or invalid pointer, potentially faulting or incorrectly skipping the first OPP. Initialize prev_o to NULL. This matches the intent as well: there is no previous OPP to compare against on the first iteration. Found with Clang's -Wconditional-uninitialized.
02KernelScan AI Analysis
Risk summary
A local privileged attacker with root or CAP_SYS_ADMIN on a MediaTek SoC using MFlexGraphics can trigger a kernel panic or oops by attaching a device to the MFlexGraphics power domain, causing a denial of service. The bug is limited to specific MediaTek hardware and requires privileged access to trigger.
Vulnerability analysis
In the MediaTek MFlexGraphics power domain driver, a pointer used to track the previous operating performance point is read before it is ever assigned a value. On the first loop iteration, this uninitialized pointer may happen to contain a non-NULL garbage value, leading the code to dereference a stale or invalid address. This can fault the kernel or silently skip the first performance point entry. The fix ensures the pointer starts out as NULL so the first iteration correctly bypasses the comparison. The flaw only affects MediaTek SoCs with MFlexGraphics silicon, and the attach operation that reaches it requires privileged access.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 6.19 | 7.2 | 090a95dbe13d |
| 7.1 | 6.19 | 7.1.10 | de4eec0dfde8 |