What is the CVSS score of CVE-2026-80750?

CVE-2026-80750 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-80750?

Linux systems using MediaTek processors (common in Android devices and IoT hardware) face a vulnerability that could degrade device stability or expose data.. A patch is available.

How to fix or mitigate CVE-2026-80750?

Within 24 hours, inventory all Linux systems running kernel versions 6.17.x, 6.18.0-6.18.45, 7.0.x, 7.1.0-7.1.9, or any 7.2.0-7.2.x with MediaTek power domain drivers. Within 7 days, apply vendor patches by upgrading to Linux 6.18.46 or later, 7.1.10 or later, or 7.2 with the integrated fix; prioritize production environments. Within 30 days, complete patching of all affected systems and schedule kernel reboots to activate the updates.

Linux Kernel CVE-2026-80750

EUVD-2026-70354 HIGH

2026-09-03 Linux

GHSA-r977-99pr-5gm5

Linux Mediatek Suse

8.4

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Triggering the probe error path requires local access with device-tree control, raising AC to H and PR to L over the vendor's PR:N/AC:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.3 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 04, 2026 - 05:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Sep 04, 2026 - 05:32 vuln.today

CVSS changed

Sep 04, 2026 - 05:22 NVD

8.4 (HIGH)

Patch available

Sep 03, 2026 - 10:16 EUVD

CVE Published

Sep 03, 2026 - 08:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 03, 2026 - 08:26 cve.org

HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

pmdomain: mediatek: fix remaining %pOF after of_node_put()

scpsys_get_bus_protection_legacy() looks up several legacy bus protection regmaps from device-tree nodes.

Two error paths put the device node before checking whether the regmap lookup failed, but still pass that node to dev_err_probe() with %pOF on failure. If of_node_put() drops the last reference, the later %pOF formatting can dereference a freed device node.

Keep the node reference until after the error message has been emitted in the infracfg and SMI lookup paths. Also drop the SMI node before returning when the SMI phandle is missing.

AnalysisAI

Use-after-free in the Linux kernel's MediaTek power domain driver exposes kernel memory to potential corruption via a dangling device-tree node pointer. In scpsys_get_bus_protection_legacy(), two error paths call of_node_put() to release infracfg and SMI device-tree node references before those nodes are passed to dev_err_probe() with the %pOF format specifier; if the put drops the last reference, the formatter dereferences freed memory. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires local access to a Linux system running on MediaTek SoC hardware (embedded ARM boards, MediaTek-based mobile or IoT devices) with the pmdomain/mediatek driver (mt-scpsys) loaded. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is significantly lower than the 8.4 CVSS base score suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Linux 6.18.46, 7.1.10, or 7.2, which incorporate the three stable-tree fixes: 3e013bc8b941bd52c8e3a99798d0ae8792cb71ca, 970b9c83a07c405fdd32bcce7cc4c9e670e58875, and 10bf2d7261d7f724ed43a09eea4c90c19c0230a0 (available at https://git.kernel.org/stable/c/ with respective commit hashes). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Linux systems running kernel versions 6.17.x, 6.18.0-6.18.45, 7.0.x, 7.1.0-7.1.9, or any 7.2.0-7.2.x with MediaTek power domain drivers. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mediatek

View all

CVE-2017-3216 CRITICAL Act Now POC

9.8 Jun 20

WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypa

CVE-2024-20017 CRITICAL Act Now POC

9.8 Mar 04

In wlan service, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS

CVE-2019-15027 CRITICAL Act Now POC

9.8 Aug 14

The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows atta

CVE-2016-6492 HIGH This Week POC

7.8 Jan 12

The MT6573FDVT_SetRegHW function in camera_fdvt.c in the MediaTek driver for Linux allows local users to gain privileges

CVE-2023-32874 CRITICAL Act Now

9.8 Jan 02

In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. Rated critical severity (CVSS

CVE-2025-20654 CRITICAL Act Now

9.8 Apr 07

In wlan service, there is a possible out of bounds write due to an incorrect bounds check. Rated critical severity (CVSS

CVE-2025-20646 CRITICAL Act Now

9.8 Mar 03

In wlan AP FW, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9

CVE-2025-20672 CRITICAL Act Now

9.8 Jun 02

Heap OOB write in Android Bluetooth driver via incorrect bounds check.

CVE-2025-20674 CRITICAL Act Now

9.8 Jun 02

Remote privilege escalation in Android WLAN AP driver via packet injection.

CVE-2025-20684 CRITICAL Act Now

9.8 Jul 08

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es

CVE-2025-20683 CRITICAL Act Now

9.8 Jul 08

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es

CVE-2025-20682 CRITICAL Act Now

9.8 Jul 08

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-80750 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-80750

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Mediatek

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code