A high-severity memory management flaw in the Linux kernel MediaTek driver could allow a local attacker to trigger a system crash or potentially achieve arbitrary code execution.

This vulnerability is a use-after-free flaw within the scpsys_get_bus_protection_legacy function, where a device tree node reference is released before an error logging operation attempts to access it. An attacker with local access can trigger this condition by manipulating specific device tree inputs, leading to the dereferencing of freed memory.

The CVSS score of 8.4 reflects the potential for full system compromise, including the loss of confidentiality, integrity, and availability. While the attack vector is local, successful exploitation could allow an attacker to escalate privileges or cause a kernel panic, resulting in significant service disruption and potential data exposure in multi-tenant environments.

Immediate Action: Update the Linux kernel to version 6.18.46, 7.1.10, or a later stable release where this issue has been addressed.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults related to the scpsys or pmdomain drivers, which may indicate attempted exploitation.

Compensating Controls: Ensure that local access to the affected hardware is restricted to authorized personnel only, as this vulnerability requires local interaction to trigger the race condition or error path.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the critical nature of kernel-level flaws, organizations running affected Linux kernel versions should prioritize the application of security patches. Updating the kernel to the specified fixed versions is the only definitive way to eliminate the risk of memory corruption associated with this vulnerability.