CVE-2026-45909 Overview
CVE-2026-45909 is a Linux kernel vulnerability in the MediaTek clock (clk) driver subsystem. The issue stems from incorrect use of the __initconst annotation on mtk_gate structures. After commit 8ceff24a754a ("clk: mediatek: clk-gate: Refactor mtk_clk_register_gate to use mtk_gate struct"), these structures are referenced at runtime, not only during kernel initialization. Because __initconst-marked data is freed by the kernel once boot completes, runtime accesses to these gate structures can reference released memory on MediaTek platforms.
Critical Impact
Runtime access to memory freed after kernel initialization can cause undefined behavior, kernel instability, or crashes on affected MediaTek-based Linux systems.
Affected Products
- Linux kernel versions containing commit 8ceff24a754a prior to the fix
- MediaTek SoC platforms using the clk-gate driver
- Distributions shipping vulnerable upstream Linux kernel builds
Discovery Timeline
- 2026-05-27 - CVE-2026-45909 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45909
Vulnerability Analysis
The Linux kernel uses the __initconst annotation to place constant data into a special section that the kernel reclaims after boot. Data placed in this section is intended only for one-time use during initialization. The MediaTek clock gate driver originally treated mtk_gate structures as init-only registration data, making __initconst an appropriate marker.
The refactor in commit 8ceff24a754a changed the lifecycle of mtk_gate. The structures became active runtime descriptors used by mtk_clk_register_gate and related clock operations. The __initconst annotation was not updated to reflect the new lifecycle. As a result, the kernel can free memory backing these structures while the clock framework still holds references.
The fix removes the __initconst annotation so the gate structures persist for the lifetime of the kernel. This kernel issue is a memory management defect [CWE-825] tied to incorrect section placement of long-lived data.
Root Cause
The root cause is a mismatch between data lifetime and section attribute. mtk_gate structures are declared with __initconst, instructing the linker to place them in the .init section. The kernel frees this section after boot. The post-refactor code paths dereference these structures during runtime clock operations, producing access to freed memory.
Attack Vector
This defect is a stability and reliability issue rather than a typical remote attack surface. Triggering the condition requires runtime clock-gate operations on affected MediaTek hardware after the init section has been reclaimed. There is no known remote exploitation path, and the EPSS score is 0.017%, reflecting negligible exploitation probability. Local impact is limited to kernel instability on affected platforms.
No verified public proof-of-concept code is available. See the upstream commits for the precise source-level fix: Linux Kernel Commit 1debd9b, Linux Kernel Commit 866d8ec, and Linux Kernel Commit 871afb4.
Detection Methods for CVE-2026-45909
Indicators of Compromise
- Kernel oops or panic messages referencing mtk_clk_register_gate, mtk_gate, or MediaTek clock framework functions
- Unexpected clock-gating failures on MediaTek SoCs after boot completes
- Memory access faults pointing at addresses within the freed .init section
Detection Strategies
- Inventory running kernels and identify MediaTek-based devices using uname -r and platform identifiers under /sys/devices/soc0/
- Compare installed kernel versions against the upstream stable trees containing the listed fix commits
- Review dmesg and journalctl -k output for clock subsystem warnings or page-fault traces involving MediaTek drivers
Monitoring Recommendations
- Aggregate kernel logs from MediaTek-based Linux fleets into a centralized log platform for trend analysis
- Alert on repeated kernel faults referencing the clk subsystem on MediaTek hardware
- Track vendor and distribution security advisories for backports of the upstream fix
How to Mitigate CVE-2026-45909
Immediate Actions Required
- Identify Linux systems running on MediaTek SoCs that include commit 8ceff24a754a but lack the corresponding __initconst removal patches
- Apply distribution kernel updates that incorporate the upstream fix commits as soon as they become available
- Reboot patched systems to load the corrected kernel image
Patch Information
The upstream Linux kernel fix removes the __initconst annotation from the affected mtk_gate structures. The fix is available in the stable kernel commits 1debd9b, 866d8ec, and 871afb4. Consume the fix through your Linux distribution's kernel update channel or by rebuilding from a patched stable tree.
Workarounds
- No supported workaround exists; the only reliable remediation is applying the kernel patch
- For non-production MediaTek systems, defer enabling dynamic clock-gating workloads until a patched kernel is installed
- Restrict physical and local access to affected devices to reduce exposure to instability-driven impact
# Verify kernel version and check for the fix on a MediaTek Linux system
uname -r
grep -r "mtk_gate" /proc/kallsyms | head
# After updating, confirm the package version includes the upstream patch
# Example for Debian-based systems:
apt-cache policy linux-image-$(uname -r)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
