Description

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtk_mfg_attach_dev() reads prev_o on the first iteration of its loop, in "if (prev_o && prev_o->freq == o->freq)", before prev_o is assigned at the end of the loop body. On that first iteration, evaluating prev_o reads an indeterminate value. If it is non-NULL, the condition dereferences a stale or invalid pointer, potentially faulting or incorrectly skipping the first OPP. Initialize prev_o to NULL. This matches the intent as well: there is no previous OPP to compare against on the first iteration. Found with Clang's -Wconditional-uninitialized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-03T13:06:14.770Z",
  "pubdate": "2026-09-03T13:06:14.770Z",
  "executiveSummary": "The Linux kernel pmdomain component for MediaTek hardware contains an uninitialized pointer vulnerability within the mtk_mfg_attach_dev function.\nThis flaw involves reading an indeterminate memory address during the initial iteration of an operating performance point (OPP) processing loop.\nThe vulnerability type is classified as an Uninitialized Variable/Pointer Dereference, which can lead to system instability, kernel panics, or potential security bypasses.\nThe issue primarily impacts devices utilizing the MediaTek mfg (manufacturing/GPU) power domain management subsystem.\nAn attacker capable of triggering the power domain attachment logic could potentially cause a denial-of-service (DoS) condition by inducing a kernel fault.\nSuccessful exploitation requires the uninitialized pointer to contain a non-NULL value by chance, making it a reliability and safety concern rather than a direct remote code execution vector.\nThe risk is exacerbated by the potential for unpredictable kernel behavior if the dereferenced pointer maps to an accessible, yet invalid, memory region.",
  "technicalDetails": "The root cause of this vulnerability is a failure to properly initialize the 'prev_o' pointer variable within the mtk_mfg_attach_dev function in the Linux kernel's MediaTek pmdomain driver.\nThe function implements a loop designed to iterate through Operating Performance Points (OPPs) for power management. The logic requires comparing the current OPP ('o') with the previously processed OPP ('prev_o').\nIn the first iteration of this loop, the code evaluates the conditional statement: 'if (prev_o && prev_o->freq == o->freq)'. Because 'prev_o' has not been initialized or assigned a value prior to this check, the register or stack location holding 'prev_o' contains stale, indeterminate data from previous function calls or stack usage.\nThe attack flow occurs when the kernel executes the path leading to mtk_mfg_attach_dev. If the indeterminate value in the 'prev_o' pointer is interpreted as non-NULL, the kernel proceeds to dereference this garbage pointer to access the 'freq' member.\nThis behavior triggers an illegal memory access. If the address is invalid, the kernel will generate a page fault, leading to a kernel panic and subsequent Denial of Service (DoS).\nIf the address happens to point to existing kernel memory, the comparison could return a false positive or negative result, leading to improper configuration of the power domain settings. This could result in incorrect frequency scaling, thermal management failures, or inconsistent hardware states.\nThis flaw was identified via Clang's '-Wconditional-uninitialized' compiler warning, which detects paths where a variable may be used before its initialization. The fix requires explicit initialization of 'prev_o' to NULL, ensuring that the first iteration correctly evaluates the conditional pointer as false, thereby skipping the comparison as intended.\nThe vulnerability exists within the context of hardware power domain management, requiring local execution or a driver-triggering event to manifest. There are no authentication requirements for this local fault beyond the ability to trigger the driver's power attachment routine, which is typically handled by the kernel's power management framework during device initialization or power state transitions."
}