CVE-2026-89885

media: platform: mtk-mdp3: Fix SCP device refcounting

State: Published
Severity: 8.4 High
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: platform: mtk-mdp3: Fix SCP device refcounting

mdp_probe() first tries to get the SCP handle with scp_get(). When that fails, it falls back to looking up the SCP platform device with __get_pdev_by_id() and then reads its driver data.

The fallback lookup returns the platform device with a reference, just like scp_get() does. However, the fallback path currently drops that reference immediately after platform_get_drvdata(). The driver later still calls scp_put(mdp->scp) unconditionally from the probe error path and from mdp_video_device_release(), which drops the SCP device reference again.

Keep the fallback reference until the existing scp_put() call, so that the fallback path follows the same ownership rules as the scp_get() path.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	db4d27e6bbbf511f9cdb33f682535a0a3cb7c403 to before dce13bd9bade3ecc1acb7579397f24743850997fAffected 31ba1a4d7a5d9466f6ef4910a372b8200f8aad19 to before 252850653569fdb1a259937e02325cf32c8f0970Affected 8f6f3aa21517ef34d50808af0c572e69580dca20 to before 0259ade4c4ceaf1e184a7c1aea8071ad398f9b6fAffected 8f6f3aa21517ef34d50808af0c572e69580dca20 to before 55793e4665b7f15151e6f5ab51ca980e73abed5dAffected 6.12.64 to before 6.12.110Affected 6.18.4 to before 6.18.51Affected
LinuxLinux	6.19Affected before 6.19Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

db4d27e6bbbf511f9cdb33f682535a0a3cb7c403 to before dce13bd9bade3ecc1acb7579397f24743850997fAffected
31ba1a4d7a5d9466f6ef4910a372b8200f8aad19 to before 252850653569fdb1a259937e02325cf32c8f0970Affected
8f6f3aa21517ef34d50808af0c572e69580dca20 to before 0259ade4c4ceaf1e184a7c1aea8071ad398f9b6fAffected
8f6f3aa21517ef34d50808af0c572e69580dca20 to before 55793e4665b7f15151e6f5ab51ca980e73abed5dAffected
6.12.64 to before 6.12.110Affected
6.18.4 to before 6.18.51Affected

LinuxLinux

6.19Affected
before 6.19Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.