CVE-2026-45909

Linux · Kernel

A code initialization vulnerability in the Linux kernel's Mediatek clock driver could cause runtime errors due to incorrect memory marking.

Executive summary

Improper memory marking in the Linux Mediatek clock driver could lead to unpredictable behavior and system instability.

Vulnerability

The vulnerability involves the incorrect use of __initconst for clock gate structures that are required at runtime. This causes the kernel to treat initialization-time data as constant/disposable, leading to potential memory access issues when those structures are accessed later.

Business impact

This flaw can result in kernel panics or system instability on devices utilizing Mediatek chips. While it has a CVSS score of 7.8, the real-world impact is largely dependent on the specific hardware/SoC implementation.

Remediation

Immediate Action: Apply the vendor-provided kernel update that removes the incorrect __initconst markers.

Proactive Monitoring: Monitor for kernel panics or hardware-related crashes on Mediatek-based devices.

Compensating Controls: There are no direct compensating controls for this internal code error; patching is the only viable remediation.

Exploitation status

Public Exploit Available: false

Analyst recommendation

Organizations deploying Linux on Mediatek hardware should prioritize this update to ensure system stability and prevent potential exploitation of the memory access error.