The vulnerability arises from using the __initconst annotation on Mediatek clock gate structures. Because these structs are used at runtime, the annotation mistakenly marks them as part of the init section, which may be discarded after boot. The patch removes this annotation so the data remains valid for the lifetime of the kernel. This change prevents improper lifetime handling of global data that could lead to kernel instability or a crash, an issue that maps to the CWE-416 (Use‑After‑Free).

Linux kernel components that provide Mediatek clock gate support, including the mtk_clk_register_gate infrastructure. No specific vendor product versions are listed, but the fix is present in any kernel that includes commit 8ceff24a. Users running kernels that integrate Mediatek hardware drivers should verify that the patch is applied.

The CVSS score is not provided and EPSS data is unavailable, and the vulnerability has not been listed in the CISA KEV catalog. The likely exploitation scenario would involve a local attacker with the ability to trigger a runtime reference to a Mis-annotated gate structure, potentially leading to a kernel panic. Because the attack requires code presence in the kernel and the vulnerability affects global data lifetime, the risk is moderate but mitigated by the absence of a public exploit and the ease of patching.