CVE-2026-89885 (GCVE-0-2026-89885)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39
VLAI
Title
media: platform: mtk-mdp3: Fix SCP device refcounting
Summary
In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: Fix SCP device refcounting mdp_probe() first tries to get the SCP handle with scp_get(). When that fails, it falls back to looking up the SCP platform device with __get_pdev_by_id() and then reads its driver data. The fallback lookup returns the platform device with a reference, just like scp_get() does. However, the fallback path currently drops that reference immediately after platform_get_drvdata(). The driver later still calls scp_put(mdp->scp) unconditionally from the probe error path and from mdp_video_device_release(), which drops the SCP device reference again. Keep the fallback reference until the existing scp_put() call, so that the fallback path follows the same ownership rules as the scp_get() path.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: db4d27e6bbbf511f9cdb33f682535a0a3cb7c403 , < dce13bd9bade3ecc1acb7579397f24743850997f (git)
Affected: 31ba1a4d7a5d9466f6ef4910a372b8200f8aad19 , < 252850653569fdb1a259937e02325cf32c8f0970 (git)
Affected: 8f6f3aa21517ef34d50808af0c572e69580dca20 , < 0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f (git)
Affected: 8f6f3aa21517ef34d50808af0c572e69580dca20 , < 55793e4665b7f15151e6f5ab51ca980e73abed5d (git)
Affected: 6.12.64 , < 6.12.110 (semver)
Affected: 6.18.4 , < 6.18.51 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dce13bd9bade3ecc1acb7579397f24743850997f",
              "status": "affected",
              "version": "db4d27e6bbbf511f9cdb33f682535a0a3cb7c403",
              "versionType": "git"
            },
            {
              "lessThan": "252850653569fdb1a259937e02325cf32c8f0970",
              "status": "affected",
              "version": "31ba1a4d7a5d9466f6ef4910a372b8200f8aad19",
              "versionType": "git"
            },
            {
              "lessThan": "0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f",
              "status": "affected",
              "version": "8f6f3aa21517ef34d50808af0c572e69580dca20",
              "versionType": "git"
            },
            {
              "lessThan": "55793e4665b7f15151e6f5ab51ca980e73abed5d",
              "status": "affected",
              "version": "8f6f3aa21517ef34d50808af0c572e69580dca20",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.110",
              "status": "affected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.51",
              "status": "affected",
              "version": "6.18.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.12.64",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.18.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: platform: mtk-mdp3: Fix SCP device refcounting\n\nmdp_probe() first tries to get the SCP handle with scp_get(). When that\nfails, it falls back to looking up the SCP platform device with\n__get_pdev_by_id() and then reads its driver data.\n\nThe fallback lookup returns the platform device with a reference, just\nlike scp_get() does. However, the fallback path currently drops that\nreference immediately after platform_get_drvdata(). The driver later\nstill calls scp_put(mdp-\u003escp) unconditionally from the probe error path\nand from mdp_video_device_release(), which drops the SCP device\nreference again.\n\nKeep the fallback reference until the existing scp_put() call, so that\nthe fallback path follows the same ownership rules as the scp_get()\npath."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The extra put_device is in mdp_probe()/mdp_video_device_release of the MediaTek MDP3 platform driver, reached only via local driver-model bind on MT8183/MT8195 (boot, deferred probe, module load, or sysfs rebind). No network, Bluetooth/Wi-Fi, or USB path reaches this SCP refcounting.\nAC:L - On MT8183 the MDP RDMA node has no mediatek,scp phandle, so scp_get() fails and the compatible fallback is the production path. That path drops the of_find_device_by_node() ref then later scp_put() extra-puts; cmdq mailbox EPROBE_DEFER after the fallback makes this deterministic with no race.\nPR:N - mdp_probe() runs in driver-core context with no capable() or credential check. On MediaTek Chromebooks, phones, and embedded boards, MDP3 commonly deferred-probes at boot after the SCP fallback, so the extra put fires without a user account.\nUI:N - Platform probe and deferred-probe retries run unattended at boot or module bind on affected hardware. Opening /dev/video, mounting a filesystem, or plugging a device is not required.\nS:U - The extra put_device() use-after-free is of the host SCP platform_device inside the same kernel security authority. It does not cross a VM, IOMMU/DMA, or sandbox boundary.\nC:H - scp_put() extra-puts the SCP platform_device, which can run device_release and free the still-bound struct device. A use-after-free of that object enables reclaim and kernel-memory disclosure.\nI:H - The same device UAF is heap corruption of struct platform_device/mtk_scp still used by the SCP driver and other scp_get() holders, enabling heap spray, arbitrary write, and control-flow hijack.\nA:H - Freeing the SCP device while it remains registered, or later dereferencing the dangling scp pointer from MDP3/vcodec, causes a kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:35.735Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dce13bd9bade3ecc1acb7579397f24743850997f"
        },
        {
          "url": "https://git.kernel.org/stable/c/252850653569fdb1a259937e02325cf32c8f0970"
        },
        {
          "url": "https://git.kernel.org/stable/c/0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/55793e4665b7f15151e6f5ab51ca980e73abed5d"
        }
      ],
      "title": "media: platform: mtk-mdp3: Fix SCP device refcounting",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89885",
    "datePublished": "2026-09-16T10:31:49.746Z",
    "dateReserved": "2026-09-11T19:38:34.773Z",
    "dateUpdated": "2026-09-16T14:39:35.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89885",
      "date": "2026-09-25",
      "epss": "0.00196",
      "percentile": "0.08243"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "dce13bd9bade3ecc1acb7579397f24743850997f",
                    "status": "affected",
                    "version": "db4d27e6bbbf511f9cdb33f682535a0a3cb7c403",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "252850653569fdb1a259937e02325cf32c8f0970",
                    "status": "affected",
                    "version": "31ba1a4d7a5d9466f6ef4910a372b8200f8aad19",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f",
                    "status": "affected",
                    "version": "8f6f3aa21517ef34d50808af0c572e69580dca20",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "55793e4665b7f15151e6f5ab51ca980e73abed5d",
                    "status": "affected",
                    "version": "8f6f3aa21517ef34d50808af0c572e69580dca20",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.12.110",
                    "status": "affected",
                    "version": "6.12.64",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.51",
                    "status": "affected",
                    "version": "6.18.4",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.19"
                  },
                  {
                    "lessThan": "6.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: platform: mtk-mdp3: Fix SCP device refcounting\n\nmdp_probe() first tries to get the SCP handle with scp_get(). When that\nfails, it falls back to looking up the SCP platform device with\n__get_pdev_by_id() and then reads its driver data.\n\nThe fallback lookup returns the platform device with a reference, just\nlike scp_get() does. However, the fallback path currently drops that\nreference immediately after platform_get_drvdata(). The driver later\nstill calls scp_put(mdp-\u003escp) unconditionally from the probe error path\nand from mdp_video_device_release(), which drops the SCP device\nreference again.\n\nKeep the fallback reference until the existing scp_put() call, so that\nthe fallback path follows the same ownership rules as the scp_get()\npath."
          }
        ],
        "id": "CVE-2026-89885",
        "lastModified": "2026-09-16T15:18:15.090",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:56.983",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/252850653569fdb1a259937e02325cf32c8f0970"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/55793e4665b7f15151e6f5ab51ca980e73abed5d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dce13bd9bade3ecc1acb7579397f24743850997f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.