CVE-2026-20492

Potential Local Denial of Service via Audio HAL Race Condition on MediaTek Chipsets

Published Aug 3, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In Audio HAL, there is a possible system becoming unresponsive due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10960026 (Note: For MT6880, MT6890, MT6990, MT6988) / AUTO00851250 (Note: For MT2735, MT2737); Issue ID: MSV-7583.

Analysis

Technical impact

The vulnerability is a race condition in the Audio HAL component that can render the system unresponsive. An attacker with local user privileges could trigger the race condition without needing additional interaction, leading to a loss of availability. The flaw does not expose confidential data or alter system integrity, but it disrupts audio services and overall system responsiveness.

Affected Systems

MediaTek chipsets, including MT6880, MT6890, MT6990, MT6988, MT2735, and MT2737, are affected. The issue resides specifically in the Audio HAL of these devices.

Risk and Exploitability

Because the flaw requires user‑level execution on the device and no external network interaction, the risk is moderate. The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be local, meaning an attacker must have access to the device or user involvement, which lowers the probability of widespread exploitation. The CVSS score is 5.5, indicating moderate severity.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

MediaTek, Inc.

MediaTek chipset

unaffected

Version	Status	Constraints
`MT2735`	affected	—
`MT2737`	affected	—
`MT6880`	affected	—
`MT6890`	affected	—
`MT6988`	affected	—
`MT6990`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Mediatek, Inc.

Mediatek Chipset

Version	Status	Scheme	Platform
`MT2735`	affected	generic	—
`MT2737`	affected	generic	—
`MT6880`	affected	generic	—
`MT6890`	affected	generic	—
`MT6988`	affected	generic	—
`MT6990`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the MediaTek firmware patch ALPS10960026 for MT6880, MT6890, MT6990, and MT6988 or AUTO00851250 for MT2735 and MT2737.
After applying the patch, reboot the device to ensure the updated Audio HAL is in use.
If patching is delayed, reduce service exposure by disabling or restricting the audio subsystem until the patch can be installed.

Generated by OpenCVE AI on August 4, 2026 at 10:47 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.113% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.mediatek.com/product-security-bulletin/August-2026

History

Aug 19, 2026 3:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mediatek Mediatek mt2735 Mediatek mt2735 Firmware Mediatek mt2737 Mediatek mt2737 Firmware Mediatek mt6880 Mediatek mt6880 Firmware Mediatek mt6890 Mediatek mt6890 Firmware Mediatek mt6988 Mediatek mt6988 Firmware Mediatek mt6990 Mediatek mt6990 Firmware
CPEs		cpe:2.3:h:mediatek:mt2735:-:::::::* cpe:2.3:h:mediatek:mt2737:-:::::::* cpe:2.3:h:mediatek:mt6880:-:::::::* cpe:2.3:h:mediatek:mt6890:-:::::::* cpe:2.3:h:mediatek:mt6988:-:::::::* cpe:2.3:h:mediatek:mt6990:-:::::::* cpe:2.3:o:mediatek:mt2735_firmware:-:::::::* cpe:2.3:o:mediatek:mt2737_firmware:-:::::::* cpe:2.3:o:mediatek:mt6880_firmware:-:::::::* cpe:2.3:o:mediatek:mt6890_firmware:-:::::::* cpe:2.3:o:mediatek:mt6988_firmware:-:::::::* cpe:2.3:o:mediatek:mt6990_firmware:-:::::::*
Vendors & Products		Mediatek Mediatek mt2735 Mediatek mt2735 Firmware Mediatek mt2737 Mediatek mt2737 Firmware Mediatek mt6880 Mediatek mt6880 Firmware Mediatek mt6890 Mediatek mt6890 Firmware Mediatek mt6988 Mediatek mt6988 Firmware Mediatek mt6990 Mediatek mt6990 Firmware

Aug 4, 2026 11:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Potential Local Denial of Service via Audio HAL Race Condition on MediaTek Chipsets

Aug 3, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 3, 2026 5:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mediatek, Inc. Mediatek, Inc. mediatek Chipset
Vendors & Products		Mediatek, Inc. Mediatek, Inc. mediatek Chipset

Aug 3, 2026 2:45 AM Description updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		In Audio HAL, there is a possible system becoming unresponsive due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10960026 (Note: For MT6880, MT6890, MT6990, MT6988) / AUTO00851250 (Note: For MT2735, MT2737); Issue ID: MSV-7583.
Weaknesses		CWE-367
References		https://www.mediatek.com/product-security-bulletin/August-2026