CVE-2026-72008: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check

Published Aug 15, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check

Should probe fail for HWVOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECTCTL domains, but only after checking if the target domain is powered on... with the DIRECTCTL scpsysdomainison() code again.

And there's more: the scpsysdomainison() function is also being unconditionally used in the probe path, for any power domain that has flag MTKSCPDKEEPDEFAULTOFF!

This bug was never experienced by anyone because the HWV domains never failed probe, and because none of those is declared with the aforementioned flag - but it's still something critical.

In order to fix this, add a check for MTCMOS Type and, based on that, call the correct functions for an "is on" check, and also do the same for the cleanup path, calling the correct functions for the "power off" action.

For the latter, since there's a call to pmgenpdremove() right before calling poweroff, be cautious and add a variation of the power off functions (with a internal suffix) for those to get a pointer to scpsysdomain instead of one to genericpmdomain as, even if that's still working, this is way too much fragile and would break at some point.

Affected Software

1 affected component
Linux Linux kernel

Event History

Aug 15, 2026
CVE Published
via MITRE·05:51 AM
Data Sourced
via MITRE·05:51 AM
Description
Data Sourced
via NVD·06:20 AM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-72008?

CVE-2026-72008 has a severity rating of 21.

2

How do I fix CVE-2026-72008?

To fix CVE-2026-72008, update the Linux kernel to the latest version where the vulnerability has been patched.

3

What type of vulnerability is CVE-2026-72008?

CVE-2026-72008 is classified as a Null Pointer Dereference vulnerability.

4

What component of the Linux kernel is affected by CVE-2026-72008?

CVE-2026-72008 affects the pmdomain component in the MediaTek driver within the Linux kernel.

5

When was CVE-2026-72008 published?

CVE-2026-72008 was published on August 15, 2026.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203