Linux Kernel CVE-2026-45881

Exploitation requires local access to a Linux system running on a MediaTek SoC with the SVS driver compiled in (CONFIG_MTK_SVS=y or =m and module loaded). The attacker must have write access to the debugfs entry for the SVS subsystem, which in default kernel configurations requires root privileges or CAP_SYS_ADMIN - the NVD-assigned PR:L should be verified, as debugfs is typically root-gated. Exploitation is further limited to platforms that actually instantiate the MediaTek SVS hardware node (i.e., MediaTek Helio/Dimensity SoC-based boards), excluding all x86, AMD64, and non-MediaTek ARM systems entirely. Repeated writes are required to accumulate meaningful memory pressure, making this a slow denial-of-service rather than an instant-impact exploit.

Real-world risk is low. The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly identifies local access as a prerequisite, but PR:L may overstate accessibility - the MediaTek SVS debugfs node is typically only writable by root or processes with CAP_SYS_ADMIN, suggesting the practical privilege barrier is higher than PR:L implies; this discrepancy should be verified against specific kernel build configurations. EPSS of 0.02% at the 7th percentile confirms that the broader security community has observed essentially zero exploitation activity. KEV status is absent, and no public proof-of-concept is known. The availability-only impact (A:H, C:N, I:N) means the worst outcome is a local denial-of-service through kernel memory exhaustion - not code execution or data exfiltration. The 'Information Disclosure' tag in the source data appears to be a mis-categorization; the CVE description and CWE-401 indicate a memory leak (availability/DoS), not a disclosure. Overall: this is a genuine kernel defect warranting a routine patch cycle update, not emergency response.

A local attacker with write access to the MediaTek SVS debugfs interface (typically requiring root or CAP_SYS_ADMIN) repeatedly writes non-integer strings to the svs_enable_debug file, causing kstrtoint() to fail on each write and leak a small kernel buffer each time. Over many iterations this slowly exhausts non-pageable kernel memory, eventually triggering an out-of-memory condition that crashes or hangs the system. No public proof-of-concept is known at time of analysis.