CVE-2026-46308 Details
Description
In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() In scpsys_get_bus_protection_legacy(), of_find_node_with_property() returns a device node with its reference count incremented. The function then calls of_node_put(node) before checking whether syscon_regmap_lookup_by_phandle() returns an error. If an error occurs, dev_err_probe() dereferences the node pointer to print diagnostic information, but the node memory may have already been freed due to the earlier of_node_put(), leading to a use-after-free vulnerability. Fix this by moving the of_node_put() call after the error check, ensuring the node is still valid when accessed in the error path.
A use-after-free vulnerability has been identified in the Linux kernel's PMDomain Mediatek driver, specifically within the 'scpsys_get_bus_protection_legacy()' function. The issue arises because the function improperly manages the reference count of a device node. It calls 'of_node_put()' to decrement the reference count before verifying if 'syscon_regmap_lookup_by_phandle()' encounters an error. If an error does occur, 'dev_err_probe()' attempts to access the node to provide error details, but the node may have already been freed, leading to a use-after-free condition. This vulnerability affects the Linux kernel stable tree.
The vulnerability has been fixed by adjusting the order of operations in the 'scpsys_get_bus_protection_legacy()' function. The 'of_node_put()' call has been moved to after the error check, ensuring that the node remains valid when accessed for error reporting. Users should upgrade to the latest version of the Linux kernel where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/38d8410021b55d226847b2ac8d189d89fe5a8866 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cb27e43c0511e9e1ca8818d231656070b11c18cf | kernel.org | Patch |
| https://git.kernel.org/stable/c/ec1fcddb3117d9452210e838fd37389ee61e10e8 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.18, < 6.18.30 >= 6.19, < 7.0.7 7.1 rc1 7.1 rc2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 8, 2026 | New CVE Received | kernel.org |