The vulnerability in the Linux kernel's pmdomain Mediatek driver involves a use-after-free condition in the function scpsys_get_bus_protection_legacy(). Specifically, the function of_find_node_with_property() increments the reference count of a device node, but the subsequent call to of_node_put() occurs before checking the result of syscon_regmap_lookup_by_phandle(). If syscon_regmap_lookup_by_phandle() returns an error, the code attempts to log diagnostic information by dereferencing the node pointer, which may have already been freed, causing a use-after-free vulnerability. The fix moves the of_node_put() call after the error check to ensure the node remains valid during error handling.

Successful exploitation of this use-after-free vulnerability could lead to kernel memory corruption, potentially allowing an attacker with local privileges to cause denial of service or escalate privileges. The CVSS 3.1 vector indicates low attack complexity and privileges required, with high impact on confidentiality, integrity, and availability.

A fix is available that corrects the order of reference count decrementing in the affected function. Users should update to linux-hwe-edge kernel versions 7.0.0-28.28.1 or later where this vulnerability is resolved. No additional mitigations are specified or required beyond applying the official fix.