Description
In the Linux kernel, the following vulnerability has been resolved:

pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check

Should probe fail for HW_VOTER type power domains, this driver was
unconditionally trying to perform cleanup for DIRECT_CTL domains,
but only after checking if the target domain is powered on... with
the DIRECT_CTL scpsys_domain_is_on() code again.

And there's more: the scpsys_domain_is_on() function is also being
unconditionally used in the probe path, for any power domain that
has flag MTK_SCPD_KEEP_DEFAULT_OFF!

This bug was never experienced by anyone because the HWV domains
never failed probe, and because none of those is declared with the
aforementioned flag - but it's still something critical.

In order to fix this, add a check for MTCMOS Type and, based on
that, call the correct functions for an "is on" check, and also
do the same for the cleanup path, calling the correct functions
for the "power off" action.

For the latter, since there's a call to pm_genpd_remove() right
before calling power_off, be cautious and add a variation of the
power off functions (with a _internal suffix) for those to get a
pointer to scpsys_domain instead of one to generic_pm_domain as,
even if that's still working, this is way too much fragile and
would break at some point.
Published: 2026-08-15
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This flaw occurs in the Mediatek power‑domain driver when a probe fails; the driver unconditionally invokes cleanup or state‑check routines that dereference a null pointer. The resulting kernel panic halts the entire system, offering attackers a path to disrupt services but not to execute arbitrary code. The weakness is a classic null‑pointer dereference (CWE‑690).

Affected Systems

All Linux kernel configurations that contain the Mediatek power‑domain driver are affected. No specific kernel releases are listed, so any distribution that includes the Mediatek driver in the kernel remains at risk until the patch is applied.

Risk and Exploitability

The CVSS and EPSS metrics are not publicly available and the vulnerability is absent from CISA KEV. Because the bug only manifests when a probe for a HW_VOTER type fails—a situation that has not been observed—the known exploitation likelihood is low. Nevertheless, if the fault is triggered, the kernel will panic, producing a denial of service. Attackers could potentially coerce a probe failure by manipulating firmware or injecting power‑domain requests, but such scenarios are highly speculative and not documented.

Generated by OpenCVE AI on August 15, 2026 at 21:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the kernel patch that adds null‑pointer checks and correct function calls for MTCMOS types in the Mediatek power‑domain driver.
  • Reboot the system and exercise typical power‑cycle operations to confirm that the driver no longer triggers a kernel panic during probe or cleanup.
  • If an immediate kernel upgrade cannot be performed, adjust boot or firmware settings to disable automatic power‑domain probing for domains marked with the MTK_SCPD_KEEP_DEFAULT_OFF flag until the upstream patch is applied.

Generated by OpenCVE AI on August 15, 2026 at 21:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 15 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
CWE-690

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HW_VOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECT_CTL domains, but only after checking if the target domain is powered on... with the DIRECT_CTL scpsys_domain_is_on() code again. And there's more: the scpsys_domain_is_on() function is also being unconditionally used in the probe path, for any power domain that has flag MTK_SCPD_KEEP_DEFAULT_OFF! This bug was never experienced by anyone because the HWV domains never failed probe, and because none of those is declared with the aforementioned flag - but it's still something critical. In order to fix this, add a check for MTCMOS Type and, based on that, call the correct functions for an "is on" check, and also do the same for the cleanup path, calling the correct functions for the "power off" action. For the latter, since there's a call to pm_genpd_remove() right before calling power_off, be cautious and add a variation of the power off functions (with a _internal suffix) for those to get a pointer to scpsys_domain instead of one to generic_pm_domain as, even if that's still working, this is way too much fragile and would break at some point.
Title pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:51:38.102Z

Reserved: 2026-08-09T03:40:39.899Z

Link: CVE-2026-72008

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:20:59.473

Modified: 2026-08-15T06:20:59.473

Link: CVE-2026-72008

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T21:15:03Z

Weaknesses
  • CWE-476

    NULL Pointer Dereference

  • CWE-690

    Unchecked Return Value to NULL Pointer Dereference