The vulnerability is classified under CWE‑824, indicating a use‑after‑free scenario, and a secondary NVD‑CWE‑noinfo designation. It occurs when MediaTek clock gate structures, marked with __initconst, are freed after kernel initialization but still accessed at runtime. This mismatch can lead to a use‑after‑free condition that may corrupt kernel memory or cause a crash. The fix removes the __initconst annotation to keep the memory alive.

All Linux kernel builds that include the MediaTek clk driver and compile before the commit that removes the __initconst annotation are vulnerable. Systems that use a kernel containing the updated driver or do not load the MediaTek clock driver at runtime are not affected. Version details are not specified in the advisory.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Exploitation would likely require local access to the device or privileged operations that can trigger the unsafe usage of the clock gate data. Overall, the risk is moderate, mainly due to the need for kernel modifications or local access to trigger the fault.