Executive brief
A vulnerability was identified in the Linux kernel's MediaTek Smart Multimedia Interface (SMI) driver. This issue involves a memory management error where the system fails to properly release hardware references during certain driver operations. While primarily a technical stability issue, it could potentially be exploited by a local user to cause a system crash or resource exhaustion, impacting service availability.
Technical details
A reference count leak exists in the mtk-smi driver (drivers/memory/mtk-smi.c) within the Linux kernel. The vulnerability occurs because the driver fails to call put_device() to drop references taken when looking up the SMI device during a 'larb' probe if a late probe failure (such as a probe deferral) occurs or when the driver is unbound. This is classified as a missing release of memory after effective lifetime (CWE-401). An attacker with local access could potentially trigger these conditions to exhaust system resources or cause a denial-of-service. The issue has been resolved by adding the missing put_device() calls in the mtk_smi_larb_remove function and error handling paths.
Affected products
- Linux Linux Kernel 4.6 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.6
Timeline
- 2025-11-21: other: Initial patch authored
- 2026-05-06: advisory: CVE published by kernel.org
- 2026-05-13: other: NIST analysis completed
References
- https://git.kernel.org/stable/c/04057b86fdac3d4847913a97dc6552c0bff9b85e
- https://git.kernel.org/stable/c/1288bb394d464975cea18f69940f206e235e0fe7
- https://git.kernel.org/stable/c/1f23a48ff2b8ab47e514f7c84a4b1dbf9b848168
- https://git.kernel.org/stable/c/357e16a7fc9c1fef2ea37dce9bb6b9bcb1d1687d
- https://git.kernel.org/stable/c/9dae65913b32d05dbc8ff4b8a6bf04a0e49a8eb6
- https://git.kernel.org/stable/c/b9eccd59697f7e1cb9a714501d9af826e7f7e073
- https://git.kernel.org/stable/c/f69535b77fa0518ad39870c00dd2995439ed5c34