CVE-2026-46308 Overview
CVE-2026-46308 is a use-after-free vulnerability in the Linux kernel's MediaTek power domain (pmdomain) driver. The flaw resides in the scpsys_get_bus_protection_legacy() function, where a device node reference is released before its data is used in an error path. When syscon_regmap_lookup_by_phandle() returns an error, dev_err_probe() dereferences a node pointer that may have already been freed by an earlier of_node_put() call. The issue has been resolved upstream by reordering the cleanup logic to ensure the node remains valid throughout the error-handling path.
Critical Impact
A use-after-free condition in the MediaTek pmdomain driver can lead to kernel memory corruption or information disclosure on affected Linux systems during driver probe failures.
Affected Products
- Linux kernel versions containing the MediaTek scpsys legacy bus protection code
- Systems using MediaTek SoCs with the pmdomain driver
- Distributions shipping affected stable kernel branches prior to the fix
Discovery Timeline
- 2026-06-08 - CVE-2026-46308 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-46308
Vulnerability Analysis
The vulnerability is a classic use-after-free condition in the Linux kernel's MediaTek System Control Processor System (scpsys) power domain driver. The defect exists in the scpsys_get_bus_protection_legacy() function, which handles legacy bus protection configuration on MediaTek SoCs.
The function calls of_find_node_with_property() to locate a device tree node. This call returns the node with its reference count incremented, requiring a balancing of_node_put() to release the reference. The flawed code released the reference before validating the result of syscon_regmap_lookup_by_phandle(). When that lookup fails, the subsequent dev_err_probe() call dereferences the node pointer to print diagnostic information, accessing memory that may have already been reclaimed.
Local triggering requires a probe-time failure path, which limits practical exploitation but still presents a kernel memory safety risk.
Root Cause
The root cause is improper ordering of resource cleanup relative to error checking. The of_node_put() call was placed before the error-handling code that still needed access to the node's memory. Once the reference count reaches zero, the kernel may free the underlying device_node structure, leaving the pointer dangling. This is a memory lifetime management defect rather than an external input validation issue.
Attack Vector
The vulnerability is reachable only through driver probe failures involving the MediaTek pmdomain legacy bus protection path. An attacker would need a path that induces syscon_regmap_lookup_by_phandle() to return an error while a freed node is referenced in the diagnostic call. Exploitation primarily affects kernel stability and may enable information leakage depending on allocator behavior and heap layout at the time of the fault.
No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability mechanism is documented in the upstream patch commits referenced in the Kernel Git Commit Details.
Detection Methods for CVE-2026-46308
Indicators of Compromise
- Kernel oops or panic messages referencing scpsys_get_bus_protection_legacy in dmesg or system logs
- Unexpected probe failures for MediaTek power domain drivers accompanied by memory corruption warnings
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the pmdomain/mediatek code path
Detection Strategies
- Enable KASAN on test kernels to surface use-after-free accesses in the MediaTek pmdomain driver during boot and probe sequences
- Audit running kernel versions across MediaTek-based fleets and compare against the patched commit hashes 38d8410021b5, cb27e43c0511, and ec1fcddb3117
- Monitor kernel logs for repeated probe failure messages tied to scpsys or syscon_regmap_lookup_by_phandle errors
Monitoring Recommendations
- Centralize dmesg and journalctl output from MediaTek-based devices for correlation and anomaly detection
- Track kernel build versions across embedded and edge device inventories to identify systems still running pre-patch kernels
- Alert on kernel crashes that occur during early boot or driver initialization, which are typical for this class of defect
How to Mitigate CVE-2026-46308
Immediate Actions Required
- Apply the upstream Linux kernel patches that reorder the of_node_put() call in scpsys_get_bus_protection_legacy()
- Rebuild and deploy patched kernels across all MediaTek-based devices in production and lab environments
- Validate kernel module signatures and boot integrity after deploying the updated kernel
Patch Information
The fix moves the of_node_put() call after the error check so the device_node pointer remains valid when dev_err_probe() accesses it. Patched commits are available in the stable kernel tree: 38d8410021b5, cb27e43c0511, and ec1fcddb3117. Downstream distributions should pull these commits into their supported stable branches.
Workarounds
- If patching is not immediately possible, disable or avoid configurations that exercise the legacy bus protection probe path on affected MediaTek platforms
- Restrict the ability to load or reload kernel modules to trusted administrators only, reducing the chance of triggering the probe failure path
- Run KASAN-enabled kernels in pre-production environments to detect related memory safety regressions before deployment
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
