Linux Kernel EUVD-2026-70355

Requires local access with at least low-privilege user credentials on a system running an unpatched Linux kernel (between commit f08e7a4e8d6a and the fix commits) compiled with the MediaTek MFG power-domain driver (CONFIG_MTK_MFG_POWER_DOMAIN or equivalent enabled). The defect is triggered only during mtk_mfg_attach_dev() execution, which occurs at driver initialization or device hotplug time on hardware with a compatible MediaTek GPU power domain (e.g., specific MediaTek Dimensity or Helio SoC families). Whether the uninitialized prev_o evaluates as non-NULL depends on stack layout and prior kernel activity, making triggering the fault non-deterministic. Systems without MediaTek GPU hardware are entirely unaffected regardless of kernel version.

The vendor-assigned CVSS 7.8 (C:H/I:H/A:H) likely overstates practical impact for this specific defect. The root cause is an uninitialized local variable used only for an OPP-deduplication comparison, not a heap or buffer corruption primitive; the worst realistic outcome is a kernel NULL/stale-pointer dereference during device attachment (A:H plausible as kernel panic), with incorrect OPP selection as a secondary possibility (I:L - GPU frequency misconfiguration). Confidentiality:H from the vendor vector is not supported by the described behavior - no memory read-out or data disclosure path is established. Attack complexity is practically higher than AC:L because exploitation requires MediaTek MFG hardware, an affected kernel version, and the uninitialized stack slot landing non-NULL - AC:H is more accurate. EPSS 0.19% and absence from KEV confirm this is not being weaponized. The defect is driver-specific and narrowly scoped to MediaTek GPU platforms (e.g., MediaTek Dimensity/Helio SoCs found in Android devices and some embedded Linux boards). CVSS C:H and I:H appear borrowed from a generic kernel LPE template rather than derived from this specific code path. Overall real-world priority is low.

A local user with at least low-privilege shell access on a MediaTek GPU-equipped Linux device (e.g., an Android board or embedded SoC running mainline Linux) triggers or waits for the mtk_mfg_attach_dev() code path during driver initialization or hotplug. If the uninitialized prev_o variable holds a non-NULL garbage value inherited from prior stack contents, the kernel dereferences the invalid pointer, triggering a kernel oops or panic and crashing the system. No public proof-of-concept exists and deterministic exploitation requires stack layout control, making this scenario unlikely without access to debug or development environments.