CVE-2026-89885media: platform: mtk-mdp3: Fix SCP device refcounting
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: Fix SCP device refcounting mdp_probe() first tries to get the SCP handle with scp_get(). When that fails, it falls back to looking up the SCP platform device with __get_pdev_by_id() and then reads its driver data. The fallback lookup returns the platform device with a reference, just like scp_get() does. However, the fallback path currently drops that reference immediately after platform_get_drvdata(). The driver later still calls scp_put(mdp->scp) unconditionally from the probe error path and from mdp_video_device_release(), which drops the SCP device reference again. Keep the fallback reference until the existing scp_put() call, so that the fallback path follows the same ownership rules as the scp_get() path.
- CVSS
- 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from db4d27e6bbbf511f9cdb33f682535a0a3cb7c403 before dce13bd9bade3ecc1acb7579397f24743850997f; from 31ba1a4d7a5d9466f6ef4910a372b8200f8aad19 before 252850653569fdb1a259937e02325cf32c8f0970; from 8f6f3aa21517ef34d50808af0c572e69580dca20 before 0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f; from 8f6f3aa21517ef34d50808af0c572e69580dca20 before 55793e4665b7f15151e6f5ab51ca980e73abed5d; from 6.12.64 before 6.12.110; from 6.18.4 before 6.18.51 | CNA record |
References
- https://git.kernel.org/stable/c/dce13bd9bade3ecc1acb7579397f24743850997f
- https://git.kernel.org/stable/c/252850653569fdb1a259937e02325cf32c8f0970
- https://git.kernel.org/stable/c/0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f
- https://git.kernel.org/stable/c/55793e4665b7f15151e6f5ab51ca980e73abed5d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.