CVE-2026-89885: media: platform: mtk-mdp3: Fix SCP device refcounting
In the Linux kernel, the following vulnerability has been resolved:
media: platform: mtk-mdp3: Fix SCP device refcounting
mdpprobe() first tries to get the SCP handle with scpget(). When that fails, it falls back to looking up the SCP platform device with getpdevbyid() and then reads its driver data.
The fallback lookup returns the platform device with a reference, just like scpget() does. However, the fallback path currently drops that reference immediately after platformgetdrvdata(). The driver later still calls scpput(mdp->scp) unconditionally from the probe error path and from mdpvideodevicerelease(), which drops the SCP device reference again.
Keep the fallback reference until the existing scpput() call, so that the fallback path follows the same ownership rules as the scpget() path.
Event History
Frequently Asked Questions
When can the incorrect reference release occur?
It occurs when mdp_probe() cannot obtain the SCP handle through scp_get() and instead uses the fallback lookup of the SCP platform device. That fallback reference was released immediately, but was later released again through the existing unconditional scp_put() path.
What component or configuration path is relevant?
The issue is in the Linux kernel MediaTek MDP3 platform driver and specifically affects its fallback SCP platform-device lookup path. Systems that do not use this driver or do not enter that fallback path are not described as affected by the provided information.
What does the fix change?
The fix retains the platform-device reference returned by the fallback lookup until the driver's existing scp_put() call. This makes reference ownership consistent with the normal scp_get() path and avoids the extra reference drop.