The vulnerability is a flaw in the Mediatek device attach routine within the Linux kernel. On the first iteration of an internal loop, the code reads a variable that has not yet been initialized. If this stale value happens to be non‑NULL, the kernel attempts to dereference the address, which can either crash or produce incorrect device configuration. The result is a kernel panic that brings the system down, providing an outright denial of service to all users. The weakness is an uninitialized variable dereference and a potential null pointer dereference.

All Linux kernel builds that include the Mediatek 'mfg' attach path are affected. The bug exists in any kernel release that contains the code before the commit that sets the previous OPP pointer to NULL. Kernel distributors should verify that the commit has been integrated into their releases or apply the patch from upstream. The vulnerability does not depend on a specific kernel version beyond the presence of the uninitialized variable in that code path.

The CVSS score for this vulnerability is 7.8, and the EPSS score is < 1%; the vulnerability is not listed in CISA’s KEV catalog. The bug can only be triggered when the Mediatek device attach routine runs, which typically occurs during kernel initialization or when the device is powered on. The attack surface is local and requires privileged kernel execution; there does not appear to be a known remote exploitation path. Consequently the exploitation likelihood is low to moderate, but because a successful trigger results in an immediate system crash, the impact remains significant.