The Linux kernel’s Mediatek SCPSYS driver contained a use‑after‑free bug in the scpsys_get_bus_protection_legacy() function. The driver obtains a device node via of_find_node_with_property(), then incorrectly releases the node before checking an error return from syscon_regmap_lookup_by_phandle(). When an error occurs, dev_err_probe() dereferences the node pointer to log diagnostic information, but the node memory may have already been freed, thus enabling a use‑after‑free. This flaw (CWE‑826) could allow memory corruption or arbitrary code execution if exploited.

Vulnerable kernels are those that still include the legacy Mediatek SCPSYS driver code before the fix was merged. Any Linux distribution shipping an unpatched kernel that contains the affected code path is at risk. No specific version numbers are listed, so all kernels prior to the patch commit should be treated as vulnerable.

The CVSS score is not publicly disclosed, and the EPSS metric is unavailable. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires the ability to influence device tree data, which typically implies local or privileged access. If an attacker can inject a crafted device‑tree node or load a malicious driver that triggers the error path, the use‑after‑free could lead to kernel memory corruption, a denial of service, or privilege escalation. Consequently, the risk is considered high for affected systems, particularly those with root or privileged customers that can tamper with device tree nodes.