Executive brief
The Linux kernel's MediaTek MDP3 media driver can crash with a NULL pointer dereference if its dependency (the SCP driver) fails to load or is not yet bound. This causes the MDP3 driver initialization to fail, potentially making media processing unavailable on affected devices. The vulnerability can be triggered during system boot or when drivers are loaded out of order.
Technical details
This is a NULL pointer dereference vulnerability in the mtk-mdp3 media driver's probe function. The root cause is a missing sanity check after looking up the SCP (Secure Coprocessor) driver handle via platform_get_drvdata(). If the SCP driver has not yet been bound when mdp_probe() runs, the lookup returns NULL, but the code proceeds to dereference this pointer when calling scp_get_rproc(), causing a kernel panic. The vulnerability is triggered during driver initialization (probe phase), requiring no user interaction or authentication. The fix adds a NULL check that returns -EPROBE_DEFER to defer initialization until the SCP driver is available. Patches are available in Linux kernel 6.1 and later stable branches.
Affected products
- Linux Linux kernel 6.1 and later
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-07-06: patched: Upstream fix committed by Johan Hovold