CVE-2026-80751

CVE-2026-80751 is a use-of-uninitialized-variable flaw in the MediaTek MFG (GPU) power domain driver (pmdomain: mediatek: mfg) of the Linux kernel. In mtk_mfg_attach_dev(), the variable prev_o is read on the first loop iteration before it is ever assigned, so the code may dereference a stale or invalid pointer, potentially faulting the kernel or incorrectly skipping the first OPP (operating performance point). The flaw is triggered locally whenever a device is attached to the affected power domain and the driver enumerates OPPs; no user interaction or network access is required (CVSS 3.1: AV:L/PR:L). An attacker would at most gain a local denial of service (kernel fault) or incorrect power/OPP handling; there is no evidence of privilege escalation. Affected users are Linux systems running on MediaTek SoCs whose kernels include this MFG power-domain driver; no known exploitation, public PoC, or KEV listing exists (EPSS 0.2%).

What to do: Update affected Linux kernels to a version that includes the fix (prev_o initialized to NULL in mtk_mfg_attach_dev()) or the corresponding stable-branch backport from your distribution once available; check whether your kernel build enables the MediaTek MFG/mediatek pmdomain option and whether you run on an affected MediaTek SoC. Given the local attack vector, lack of known exploitation, and low EPSS (0.2%), patching in your normal maintenance window is reasonable.