Junglewise Threat Intelligence

CVE-2026-43207: Linux Kernel MediaTek MDP NULL pointer dereference in probe function

CVE-2026-43207 · Severity: high · CVSS 7.8 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the MediaTek Media Data Path (MDP) driver within the Linux kernel, which is responsible for image processing and video hardware acceleration. Improper error handling during the driver's initialization can lead to system instability or crashes. In a worst-case scenario, this could allow a local user to compromise the integrity or availability of the system.

Technical details

A vulnerability in the mtk-mdp driver's probe function (mtk_mdp_probe) arises from insufficient validation of the return value from vpu_get_plat_device(). If this function fails, a NULL pointer dereference occurs during subsequent operations. Additionally, the driver fails to call mtk_mdp_unregister_m2m_device() and platform_device_put() on certain error paths, leading to resource and reference count leaks. A local attacker with low privileges could potentially exploit these flaws to cause a Denial of Service (DoS) or achieve broader system compromise. The issue has been addressed by adding proper NULL checks and ensuring all resources are released during initialization failures.

Affected products

  • Linux Linux Kernel 4.10 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-05-06: disclosed
  • 2026-05-06: advisory
  • 2026-03-04: patched: Patched in various stable branches including 6.19.6, 6.18.16, and 6.12.75.

References

Related threats