CVE-2026-46308

pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()

published June 8, 2026

CVSS
—
EPSS
0%
Percentile
5.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()

In scpsys_get_bus_protection_legacy(), of_find_node_with_property()

returns a device node with its reference count incremented. The function

then calls of_node_put(node) before checking whether

syscon_regmap_lookup_by_phandle() returns an error. If an error occurs,

dev_err_probe() dereferences the node pointer to print diagnostic

information, but the node memory may have already been freed due to the

earlier of_node_put(), leading to a use-after-free vulnerability.

Fix this by moving the of_node_put() call after the error check, ensuring

the node is still valid when accessed in the error path.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.9th percentile
Published
2026-06-08T15:46Z
EPSS history
Timeline
  • 08 JUN 15:46Z
    pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()
    cvelistv5