CVE-2026-46308: pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()
In the Linux kernel, the following vulnerability has been resolved:
pmdomain: mediatek: fix use-after-free in scpsysgetbusprotectionlegacy()
In scpsysgetbusprotectionlegacy(), offindnodewithproperty() returns a device node with its reference count incremented. The function then calls ofnodeput(node) before checking whether sysconregmaplookupbyphandle() returns an error. If an error occurs, deverrprobe() dereferences the node pointer to print diagnostic information, but the node memory may have already been freed due to the earlier ofnodeput(), leading to a use-after-free vulnerability.
Fix this by moving the ofnodeput() call after the error check, ensuring the node is still valid when accessed in the error path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In pmdomain/mediatek’s scpsys_get_bus_protection_legacy(), move the of_node_put(node) call so it happens only after the of_find_node_with_property() return value is checked for error (i.e., ensure dev_err_probe() access happens while the node reference is still valid).
Linux kernel (pmdomain: mediatek) of_node_put() call ordering in scpsys_get_bus_protection_legacy() error path = Move of_node_put() to occur after of_find_node_with_property() error check
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46308?
The severity of CVE-2026-46308 is rated as risk 34.
How do I fix CVE-2026-46308?
To fix CVE-2026-46308, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What type of vulnerability is CVE-2026-46308?
CVE-2026-46308 is categorized as a Use After Free vulnerability in the Linux kernel.
Which component of the Linux kernel is affected by CVE-2026-46308?
CVE-2026-46308 specifically affects the pmdomain component of the MediaTek implementation in the Linux kernel.
What function is involved in CVE-2026-46308?
CVE-2026-46308 involves the function scpsys_get_bus_protection_legacy() within the affected code.