Security readout for executives and security teams
Plain-English summary
A Linux MediaTek clock-driver data structure was incorrectly marked as disposable after startup even though the kernel still uses it. On affected systems, this could expose invalid memory during runtime. The supplied CVSS assessment indicates a locally authenticated, low-privilege attacker could potentially cause serious confidentiality, integrity, and availability impact without user interaction.
Executive priority
Prioritize validation and patch planning for exposed MediaTek Linux systems. Accelerate remediation where untrusted users, applications, or tenant workloads have local access. Other hardware is less likely to be affected, but version strings alone are insufficient; vendor backports may change status.
Technical view
Since commit 8ceff24a754a, MediaTek mtk_gate structures remain runtime dependencies after clock-gate registration. Retaining __initconst could place them in initialization-only storage despite later use. The stable fixes remove that annotation. The sources provide no CWE classification or detailed exploitation mechanism beyond this lifetime mismatch.
Likely exposure
Exposure is most plausible on Linux systems using the affected MediaTek clock-gate driver. The bundle identifies versions including 6.18, 6.18.14, 6.19.4, and 7.0, but its flattened version data does not establish precise ranges. Confirm kernel build provenance and whether the applicable fix is present.
Exploitation context
The CVSS 3.1 vector is 7.8 and requires local access with low privileges; attack complexity is rated low and no user interaction is required. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit.
Researcher notes
The core issue is an annotation and object-lifetime mismatch introduced by refactoring commit 8ceff24a754a. Three Linux stable commit references are supplied, likely covering separate maintained branches. Exact vulnerable ranges, affected MediaTek platforms, crash behavior, and exploitability details are not fully documented in the provided bundle.
Mitigation direction
- Obtain the applicable fixed kernel package from the system or device vendor.
- Confirm the update includes the relevant Linux stable fix for this CVE.
- Prioritize MediaTek-based systems accessible to untrusted local users or workloads.
- Restrict unnecessary local access until affected systems can be updated.
Validation and detection
- Inventory Linux kernel versions and identify systems using MediaTek clock drivers.
- Compare each kernel's source or package changelog with the referenced stable commits.
- Verify the applicable mtk_gate declarations no longer retain __initconst.
- After updating, confirm systems boot and MediaTek clock-managed devices operate normally.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-45909 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1debd9ba7eb18af8fb63dc93517c6bbcab0e31eeCVE reference, Linux
- https://git.kernel.org/stable/c/866d8ecc4e789f7d73d6cafd1b122d1b6032b3b1CVE reference, Linux
- https://git.kernel.org/stable/c/871afb43e41ad4e8246438de495a939cd0f8113cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.