Description
In the Linux kernel, the following vulnerability has been resolved:

pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check

Should probe fail for HW_VOTER type power domains, this driver was
unconditionally trying to perform cleanup for DIRECT_CTL domains,
but only after checking if the target domain is powered on... with
the DIRECT_CTL scpsys_domain_is_on() code again.

And there's more: the scpsys_domain_is_on() function is also being
unconditionally used in the probe path, for any power domain that
has flag MTK_SCPD_KEEP_DEFAULT_OFF!

This bug was never experienced by anyone because the HWV domains
never failed probe, and because none of those is declared with the
aforementioned flag - but it's still something critical.

In order to fix this, add a check for MTCMOS Type and, based on
that, call the correct functions for an "is on" check, and also
do the same for the cleanup path, calling the correct functions
for the "power off" action.

For the latter, since there's a call to pm_genpd_remove() right
before calling power_off, be cautious and add a variation of the
power off functions (with a _internal suffix) for those to get a
pointer to scpsys_domain instead of one to generic_pm_domain as,
even if that's still working, this is way too much fragile and
would break at some point.
Published: 2026-08-15
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A null‑pointer dereference occurs in the Mediatek power‑domain driver when a probe for an HW_VOTER type fails or when a domain flagged MTK_SCPD_KEEP_DEFAULT_OFF is accessed. Because the driver calls functions that expect a valid domain pointer without first validating it, the kernel attempts to use a NULL reference and panics. The result is a loss of availability; the flaw does not provide a path for arbitrary code execution or data exfiltration. The weakness corresponds to CWE‑476.

Affected Systems

All Linux kernel builds that include the Mediatek power‑domain driver are affected. The driver is present in many kernel releases that support Mediatek SoCs, such as certain Android devices and embedded boards. The advisory does not list specific kernel versions, so any distribution that ships the driver without the upstream patch remains at risk until the change is integrated.

Risk and Exploitability

The CVSS v3.1 score is 5.5, indicating a moderate severity. The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, reflecting a low likelihood of widespread exploitation. The bug only triggers under uncommon conditions (failed probe or specific flag), greatly narrowing the attack surface. While no public exploits are known, an attacker could potentially induce probe failures by manipulating power‑domain states or firmware to cause a kernel panic, resulting in a denial of service for all users.

Generated by OpenCVE AI on August 18, 2026 at 05:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the upstream kernel patch that adds NULL checks and correct function calls in the Mediatek power‑domain driver (the commit referenced in the advisory).
  • Reboot the system and verify that power‑domain probes no longer cause a panic by exercising normal boot and power‑cycle operations.
  • If an immediate kernel update cannot be performed, disable automatic probing for domains marked with the MTK_SCPD_KEEP_DEFAULT_OFF flag or adjust firmware settings to prevent probe failures until the upstream patch is applied.

Generated by OpenCVE AI on August 18, 2026 at 05:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-690

Tue, 18 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sat, 15 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
CWE-690

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HW_VOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECT_CTL domains, but only after checking if the target domain is powered on... with the DIRECT_CTL scpsys_domain_is_on() code again. And there's more: the scpsys_domain_is_on() function is also being unconditionally used in the probe path, for any power domain that has flag MTK_SCPD_KEEP_DEFAULT_OFF! This bug was never experienced by anyone because the HWV domains never failed probe, and because none of those is declared with the aforementioned flag - but it's still something critical. In order to fix this, add a check for MTCMOS Type and, based on that, call the correct functions for an "is on" check, and also do the same for the cleanup path, calling the correct functions for the "power off" action. For the latter, since there's a call to pm_genpd_remove() right before calling power_off, be cautious and add a variation of the power off functions (with a _internal suffix) for those to get a pointer to scpsys_domain instead of one to generic_pm_domain as, even if that's still working, this is way too much fragile and would break at some point.
Title pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:06:29.895Z

Reserved: 2026-08-09T03:40:39.899Z

Link: CVE-2026-72008

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:20:59.473

Modified: 2026-08-17T06:17:58.263

Link: CVE-2026-72008

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72008 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T06:00:04Z

Weaknesses