CVE-2026-80751

HighCVSS 7.8/10Last modified Sep 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()

mtk_mfg_attach_dev() reads prev_o on the first iteration of its loop, in "if (prev_o && prev_o->freq == o->freq)", before prev_o is assigned at the end of the loop body. On that first iteration, evaluating prev_o reads an indeterminate value. If it is non-NULL, the condition dereferences a stale or invalid pointer, potentially faulting or incorrectly skipping the first OPP.

Initialize prev_o to NULL. This matches the intent as well: there is no previous OPP to compare against on the first iteration.

Found with Clang's -Wconditional-uninitialized.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 3, 2026
Last modified
Sep 4, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-807528.4In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpad_spi_suspend() reCVE-2026-807538.4In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues severaCVE-2026-807547.8In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo DurinCVE-2026-80755In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission countCVE-2026-80756In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started sel_writCVE-2026-80757In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common seCVE-2026-80758In the Linux kernel, the following vulnerability has been resolved: futex: Avoid private hash use-after-free on final put futex_private_haCVE-2026-80759In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_aml: validate firmware segment lengths aml_download_firCVE-2026-80769.3Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user CVE-2026-80760In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 mgmt_hci_cmdCVE-2026-80761In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname iso_sCVE-2026-80762In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix accept list UAF during suspend hci_update_eve
CVE-2026-80751: High severity, CVSS 7.8 | Vulnix