Look up another CVE · open CVE-2026-80751 in the interactive tracker
CVE-2026-80751
pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()
Published 2026-09-03 (2 months ago) by the Linux kernel CNA. Subsystem drivers/pmdomain. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-80751 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
mtk_mfg_attach_dev() reads prev_o on the first iteration of its loop, in "if (prev_o && prev_o->freq == o->freq)", before prev_o is assigned at the end of the loop body. On that first iteration, evaluating prev_o reads an indeterminate value. If it is non-NULL, the condition dereferences a stale or invalid pointer, potentially faulting or incorrectly skipping the first OPP. Initialize prev_o to NULL. This matches the intent as well: there is no previous OPP to compare against on the first iteration. Found with Clang's -Wconditional-uninitialized.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/pmdomain/mediatek/mtk-mfg-pmdomain.c
- What this is
- GENERIC PM DOMAINSMAINTAINERS section matched on drivers/pmdomain/ · linux-pm@vger.kernel.org · Supported
Check it on the machine
grep -wE 'CONFIG_MTK_MFG_PM_DOMAIN|CONFIG_PM_GENERIC_DOMAINS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed. The build rule could not be established for 2 releases, so nothing is claimed about those.
- bookworm, trixie?
- forky, sidYnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- ?
- not established - no Makefile entry for the affected file
- Y
- built in where it is built at all; some flavours do not build it
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switches
- CONFIG_MTK_MFG_PM_DOMAIN, CONFIG_PM_GENERIC_DOMAINS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-03 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/pmdomain
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.19 | 7.1.10 | de4eec0dfde8 |
| 6.19 | 7.2 | 090a95dbe13d |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- mtk_mfg_attach_dev() is only reached from the local kernel genpd attach path (panthor/Mali GPU probe → devm_pm_domain_attach_list → genpd_add_device) on MediaTek MT8196/MT6991 SoCs; there is no network, Bluetooth, or USB/physical-bus packet handler into this MFlexGraphics pmdomain code.
- AC:LAttack complexity, low
- On the first loop iteration prev_o is read before assignment; on typical ARM64 kernel stacks the uninitialized slot frequently holds non-zero garbage, so the stale prev_o->freq dereference is reached deterministically during GPU power-domain attach at boot without races or attacker-uncontrollable timing.
- PR:LPrivileges required, low
- The vulnerable path runs automatically when the Mali/panthor GPU binds to the MediaTek MFG genpd during boot on MT8196/MT6991 phones, Chromebooks, and embedded boards; sysfs driver rebind also reaches it with only local administrator access, not init-namespace root beyond ordinary local privilege.
- UI:NUser interaction, none
- No victim interaction such as opening files, mounting filesystems, or clicking prompts is required; GPU power-domain attachment and OPP registration occur automatically as part of normal platform driver probe during system bring-up.
- S:UScope, unchanged
- Impact is confined to kernel GPU power-domain and OPP setup on the same host; it does not cross VM, container, IOMMU, or firmware trust boundaries in a way that changes CVSS scope.
- C:HConfidentiality impact, high
- When the uninitialized prev_o is non-NULL the kernel dereferences a stale stack-derived pointer to read dev_pm_opp_data.freq, exposing contents from an attacker-uncontrolled kernel address; CNA guidance treats invalid-pointer reads as high confidentiality impact.
- I:HIntegrity impact, high
- Beyond the stray read, incorrectly skipping the first OPP corrupts the dynamically built GPU dev_pm_opp table used by devfreq and DVFS consumers, constituting kernel memory integrity compromise that can be leveraged for further exploitation on Mali GPU deployments.
- A:HAvailability impact, high
- Dereferencing a stale or invalid prev_o during GPU attach can cause an immediate kernel OOPS/panic, failing Mali/panthor probe and denying GPU availability on affected MediaTek devices until reboot or driver recovery.