CVE-2026-89885: media: platform: mtk-mdp3: Fix SCP device refcounting
In the Linux kernel, the following vulnerability has been resolved:
media: platform: mtk-mdp3: Fix SCP device refcounting
mdpprobe() first tries to get the SCP handle with scpget(). When that fails, it falls back to looking up the SCP platform device with getpdevbyid() and then reads its driver data.
The fallback lookup returns the platform device with a reference, just like scpget() does. However, the fallback path currently drops that reference immediately after platformgetdrvdata(). The driver later still calls scpput(mdp->scp) unconditionally from the probe error path and from mdpvideodevicerelease(), which drops the SCP device reference again.
Keep the fallback reference until the existing scpput() call, so that the fallback path follows the same ownership rules as the scpget() path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
When can the incorrect reference release occur?
It occurs when mdp_probe() cannot obtain the SCP handle through scp_get() and instead uses the fallback lookup of the SCP platform device. That fallback reference was released immediately, but was later released again through the existing unconditional scp_put() path.
What component or configuration path is relevant?
The issue is in the Linux kernel MediaTek MDP3 platform driver and specifically affects its fallback SCP platform-device lookup path. Systems that do not use this driver or do not enter that fallback path are not described as affected by the provided information.
What does the fix change?
The fix retains the platform-device reference returned by the fallback lookup until the driver's existing scp_put() call. This makes reference ownership consistent with the normal scp_get() path and avoids the extra reference drop.