{"id":"CVE-2026-89885","revision":"0b52ba56f59446e296da862bbe3f3309","records":[{"revision":"0b52ba56f59446e296da862bbe3f3309","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89885","aliases":[],"title":"media: platform: mtk-mdp3: Fix SCP device refcounting","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: platform: mtk-mdp3: Fix SCP device refcounting\n\nmdp_probe() first tries to get the SCP handle with scp_get(). When that\nfails, it falls back to looking up the SCP platform device with\n__get_pdev_by_id() and then reads its driver data.\n\nThe fallback lookup returns the platform device with a reference, just\nlike scp_get() does. However, the fallback path currently drops that\nreference immediately after platform_get_drvdata(). The driver later\nstill calls scp_put(mdp->scp) unconditionally from the probe error path\nand from mdp_video_device_release(), which drops the SCP device\nreference again.\n\nKeep the fallback reference until the existing scp_put() call, so that\nthe fallback path follows the same ownership rules as the scp_get()\npath.","state":0,"publishedAt":"2026-09-16T10:31:49.746+00:00","modifiedAt":"2026-10-19T08:54:18.396+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"db4d27e6bbbf511f9cdb33f682535a0a3cb7c403\",\n                            \"lessThan\": \"dce13bd9bade3ecc1acb7579397f24743850997f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"31ba1a4d7a5d9466f6ef4910a372b8200f8aad19\",\n                            \"lessThan\": \"252850653569fdb1a259937e02325cf32c8f0970\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8f6f3aa21517ef34d50808af0c572e69580dca20\",\n                            \"lessThan\": \"0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8f6f3aa21517ef34d50808af0c572e69580dca20\",\n                            \"lessThan\": \"55793e4665b7f15151e6f5ab51ca980e73abed5d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.12.64\",\n                            \"lessThan\": \"6.12.110\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.4\",\n                            \"lessThan\": \"6.18.51\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.19\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.19\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/dce13bd9bade3ecc1acb7579397f24743850997f","https://git.kernel.org/stable/c/252850653569fdb1a259937e02325cf32c8f0970","https://git.kernel.org/stable/c/0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f","https://git.kernel.org/stable/c/55793e4665b7f15151e6f5ab51ca980e73abed5d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89885","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89885","identifiers":["CVE-2026-89885"]},"retained":false,"historicalAffected":[]}],"coverage":[]}