Executive brief
The Linux kernel's remote processor (remoteproc) subsystem for MediaTek SCP devices contains a resource leak in the device lookup function. When a driver attempts to look up SCP device data before the driver has been fully bound, the code fails to properly release the device reference, causing kernel memory to be held indefinitely. This can lead to memory exhaustion over time if the condition is triggered repeatedly.
Technical details
This is a reference-counting bug in the remoteproc/mtk_scp.c driver's scp_get() function. The vulnerability occurs when platform_get_drvdata() returns NULL (indicating the driver data has not yet been initialized), but the code path directly returns without releasing the device reference that was acquired by a prior bus_find_device_by_name() call. The fix adds an explicit put_device() call when driver data lookup fails, ensuring proper cleanup. This affects Linux kernel 5.6 and later versions where the SCP driver was introduced. The vulnerability is a low-severity resource leak with no direct security impact but potential availability implications if exploited repeatedly.
Affected products
- Linux Linux kernel 5.6 and later
Timeline
- 2026-09-11: disclosed
- 2026-07-06: patched