In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_bus_protection_legacy() looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap lookup failed, but still pass that node to dev_err_probe() with %pOF on failure. If of_node_put() drops the last reference, the later %pOF formatting can dereference a freed device node. Keep the node reference until after the error message has been emitted in the infracfg and SMI lookup paths. Also drop the SMI node before returning when the SMI phandle is missing.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80750 is a use-after-free vulnerability in the Linux kernel's MediaTek power domain (pmdomain) driver. The vulnerability occurs in scpsys_get_bus_protection_legacy(), where device tree nodes are freed via of_node_put() before being dereferenced in error handling code. An attacker with local access could potentially exploit this memory safety flaw to achieve arbitrary code execution or denial of service by manipulating device tree structures or triggering specific error conditions during power domain initialization. This affects systems running vulnerable Linux kernel versions with MediaTek SoC support, particularly mobile devices and embedded systems using MediaTek chipsets.
While this CVE does not currently map to specific MITRE ATT&CK techniques or have documented Casky skills, practitioners using Casky.ai would benefit from the platform's code analysis capabilities to identify similar use-after-free patterns across their kernel or driver codebase. Claude AI's extended reasoning could help security teams recognize the vulnerability class—improper lifecycle management of kernel objects—by analyzing pointer dereference patterns after resource release calls. Practitioners would focus on detecting the attack surface through memory safety violations (CWE-416: Use After Free) and implement static analysis rules to flag scenarios where freed objects are referenced in error paths, particularly in device driver initialization routines.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80750. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation