CVE-2026-45909
Linux · Kernel
A code initialization vulnerability in the Linux kernel's Mediatek clock driver could cause runtime errors due to incorrect memory marking.
Executive summary
Improper memory marking in the Linux Mediatek clock driver could lead to unpredictable behavior and system instability.
Vulnerability
The vulnerability involves the incorrect use of __initconst for clock gate structures that are required at runtime. This causes the kernel to treat initialization-time data as constant/disposable, leading to potential memory access issues when those structures are accessed later.
Business impact
This flaw can result in kernel panics or system instability on devices utilizing Mediatek chips. While it has a CVSS score of 7.8, the real-world impact is largely dependent on the specific hardware/SoC implementation.
Remediation
Immediate Action: Apply the vendor-provided kernel update that removes the incorrect __initconst markers.
Proactive Monitoring: Monitor for kernel panics or hardware-related crashes on Mediatek-based devices.
Compensating Controls: There are no direct compensating controls for this internal code error; patching is the only viable remediation.
Exploitation status
Public Exploit Available: false
Analyst recommendation
Organizations deploying Linux on Mediatek hardware should prioritize this update to ensure system stability and prevent potential exploitation of the memory access error.