Description

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_bus_protection_legacy() looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap lookup failed, but still pass that node to dev_err_probe() with %pOF on failure. If of_node_put() drops the last reference, the later %pOF formatting can dereference a freed device node. Keep the node reference until after the error message has been emitted in the infracfg and SMI lookup paths. Also drop the SMI node before returning when the SMI phandle is missing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-09-03T13:06:14.650Z",
  "pubdate": "2026-09-03T13:06:14.650Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel within the Mediatek power domain driver, specifically affecting scpsys_get_bus_protection_legacy().\nThe vulnerability arises from improper management of device tree node reference counts, leading to a potential kernel panic or arbitrary code execution scenario.\nBy prematurely calling of_node_put() before logging an error, the kernel attempts to dereference a memory address that has already been deallocated during the formatted output of an error message via %pOF.\nThis issue exposes the kernel to local exploitation if an attacker can trigger the specific error paths during device probing or system initialization.\nThe impact is significant, potentially leading to system instability, denial of service (DoS), or elevated privilege execution depending on the state of the kernel heap after the node is freed.\nAffected systems are Linux-based devices utilizing Mediatek power domain components that rely on the legacy bus protection lookup mechanism.",
  "technicalDetails": "The root cause of this vulnerability is a lifetime management error in the scpsys_get_bus_protection_legacy() function within the Mediatek pmdomain driver. The function retrieves legacy bus protection regmaps by iterating through device-tree nodes.\nDuring the error handling logic, the function executes of_node_put() on a device node pointer before validating the result of the subsequent regmap lookup. If of_node_put() results in the release of the final reference to the device node, the node structure is deallocated from memory.\nHowever, the error handling path continues execution to trigger a dev_err_probe() call, which utilizes the %pOF format specifier to log the device node's path. Because the node reference has already been released, the internal printk logic attempts to traverse the freed memory to resolve the path, resulting in a use-after-free (UAF) condition.\nThe attack flow follows these steps: 1. The kernel driver attempts to initialize or probe the Mediatek power domain component. 2. The scpsys_get_bus_protection_legacy() function parses specific device tree nodes for bus protection regmaps. 3. A failure condition is triggered (e.g., a missing phandle or failed regmap lookup). 4. The code prematurely decrements the reference count of the node via of_node_put(). 5. The code proceeds to print the error message, invoking %pOF on the now-freed memory pointer. 6. The kernel encounters a memory corruption event or kernel panic when reading the invalid structure.\nThis vulnerability is localized to the initialization phase of the Mediatek driver. Exploitation typically requires local access or the ability to manipulate device tree configurations or probe sequences. While this is primarily a stability issue leading to DoS, in advanced scenarios, heap grooming could potentially allow an attacker to replace the freed node structure with controlled data, leading to control flow hijacking during the error logging process.\nThe vulnerability affects kernel versions where the scpsys_get_bus_protection_legacy() implementation improperly orders reference counting relative to error reporting. This highlights a common pattern of unsafe logging in the Linux kernel where objects with managed lifetimes are accessed after their release."
}