CVE-2026-98781: drm/mediatek: Fix pdev reference leak in mtk_drm_bind()
drm/mediatek: Fix pdev reference leak in mtkdrmbind()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1 - Compensating control
In drm/mediatek mtk_drm_bind(), drop the disp-mutex device reference obtained via of_find_device_by_node() before returning from the non-master path.
Event History
Frequently Asked Questions
Which systems are affected by this reference leak?
The issue is in the Linux kernel's MediaTek DRM bind path. It occurs when mtk_drm_bind() handles a device that is not the mmsys master after obtaining a disp-mutex device reference.
What is required to trigger the leak?
The affected bind path must run for a non-mmsys-master device. In that path, of_find_device_by_node() acquires a disp-mutex device reference and the early return does not release it.
How can I tell whether a system has been exposed to the issue?
Review the running kernel source or applied stable patches to determine whether mtk_drm_bind() drops the mutex device reference before returning on the non-master path. The provided fixes are available through the listed stable kernel commits.