The Linux kernel contains a bug that allows a device-tree node to be released before it is safely logged. When the node is freed, the subsequent formatting call still references it, leading to a dereference of a freed pointer. This use-after-free can cause the kernel to crash and fall back to a kernel panic, providing a local denial of service surface for an attacker.

All Linux kernel systems that include the Mediatek PMDomain code path are impacted. The vulnerability exists in kernels where the mediatek device-tree nodes are loaded and the function scpsys_get_bus_protection_legacy() is used. No specific kernel version range is listed; the fix is already applied in newer releases.

The CVSS score is 8.4, and the EPSS score is < 1%, so precise exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploits are in the wild. However, the use-after-free is a severe memory corruption flaw that could be leveraged by a local user with sufficient privileges or a malicious driver that triggers the error paths. The likely attack vector is a trusted user or component that can cause a regmap lookup to fail, which then leads to the crash.