Executive brief
The MTK Media Data Path 3 (mtk-mdp3) driver in the Linux kernel has a device reference-counting bug that can cause double-release of a system resource. When the driver initializes, it may prematurely release a reference to the SCP (Secure CoProcessor) device, leading to a use-after-free condition when the driver later attempts to properly clean up the reference. This can result in kernel memory corruption and system instability.
Technical details
The vulnerability is a reference-counting error in the mtk-mdp3 media platform driver's probe function. The code attempts to obtain an SCP handle via scp_get(); on failure, it falls back to looking up the SCP platform device via __get_pdev_by_id(), which returns the device with an incremented reference count. However, the fallback path incorrectly calls put_device() immediately after retrieving driver data, prematurely releasing the reference. The driver later unconditionally calls scp_put() during error handling and device release, resulting in a double-release (decrementing the reference below zero). The fix removes the premature put_device() call so both code paths maintain consistent reference semantics. No evidence of active exploitation exists; the issue is a logic error in resource lifecycle management.
Affected products
- Linux Linux kernel versions containing commit 8f6f3aa21517 and before the fix commit 55793e4665b7f15151e6f5ab51ca980e73abed5d
Timeline
- 2026-09-16: disclosed
- 2026-07-05: patched: Fix commit 55793e4665b7f15151e6f5ab51ca980e73abed5d authored