CVE-2026-80750

HighCVSS 8.4/10Last modified Sep 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

pmdomain: mediatek: fix remaining %pOF after of_node_put()

scpsys_get_bus_protection_legacy() looks up several legacy bus protection regmaps from device-tree nodes.

Two error paths put the device node before checking whether the regmap lookup failed, but still pass that node to dev_err_probe() with %pOF on failure. If of_node_put() drops the last reference, the later %pOF formatting can dereference a freed device node.

Keep the node reference until after the error message has been emitted in the infracfg and SMI lookup paths. Also drop the SMI node before returning when the SMI phandle is missing.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 3, 2026
Last modified
Sep 4, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-807517.8In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtkCVE-2026-807528.4In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpad_spi_suspend() reCVE-2026-807538.4In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues severaCVE-2026-807547.8In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo DurinCVE-2026-80755In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission countCVE-2026-80756In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started sel_writCVE-2026-80757In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common seCVE-2026-80758In the Linux kernel, the following vulnerability has been resolved: futex: Avoid private hash use-after-free on final put futex_private_haCVE-2026-80759In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_aml: validate firmware segment lengths aml_download_firCVE-2026-80769.3Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user CVE-2026-80760In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 mgmt_hci_cmdCVE-2026-80761In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname iso_s
CVE-2026-80750: High severity, CVSS 8.4 | Vulnix