The vulnerability arises from the improper marking of MediaTek clock gate data structures with the __initconst annotation, meaning that the memory is slated for deallocation after kernel initialization while the structures are later accessed at runtime. This mismatch can lead to a use‑after‑free condition, which, if exploited, may corrupt kernel memory or cause a crash. The fix removes the annotation to keep the memory alive. The description does not explicitly state the impact, but it is inferred that such a use‑after‑free could result in kernel instability.

All Linux kernel builds that include the MediaTek clk driver and compile before the commit that removes the __initconst annotation are vulnerable. Systems that use a kernel containing the updated driver or do not load the MediaTek clock driver at runtime are not affected. Version details are not specified in the advisory.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Exploitation would likely require local access to the device or privileged operations that can trigger the unsafe usage of the clock gate data. Overall, the risk is moderate, mainly due to the need for kernel modifications or local access to trigger the fault.