CVE-2026-43207 - Vulnerability Details

- media: mtk-mdp: Fix error handling in probe function

Description

In the Linux kernel, the following vulnerability has been resolved:

media: mtk-mdp: Fix error handling in probe function

Add mtk_mdp_unregister_m2m_device() on the error handling path to prevent
resource leak.

Add check for the return value of vpu_get_plat_device() to prevent null
pointer dereference. And vpu_get_plat_device() increases the reference
count of the returned platform device. Add platform_device_put() to
prevent reference leak.

Published: 2026-05-06

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The MediaTek MDP driver in the Linux kernel contains a flaw in its probe routine that can lead to a null pointer dereference and insufficient cleanup of platform devices. If the driver fails to retrieve a platform device correctly, the kernel may access a null pointer, causing a crash. The patch adds error‑path cleanup and protects against reference‑count leaks, thereby preventing potential denial‑of‑service incidents.

Affected Systems

All Linux kernel releases that include the MediaTek MDP (mtk-mdp) driver before the patch commits referenced in the CVE are affected. The vendor product in question is the Linux kernel MediaTek MDP driver; no specific kernel series or patch level is enumerated in the data.

Risk and Exploitability

The vulnerability has a CVSS score of 7.8 and an EPSS score of < 1%, indicating moderate severity but a very low likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is not explicitly documented, but it is inferred that a local user or administrator who can trigger the driver’s probe routine, such as by loading kernel modules or manipulating device enumeration, could potentially exploit the flaw. No known exploits are reported.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a`	affected	< 9d9c67976eda502edc6b3a148a1c5b6a18b69a98
`c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a`	affected	< 0bc43eaf021347f8d5aba87712c36b799695eec6
`c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a`	affected	< 9d7962d5c81d6cf3f8dbdb5c71c57600bac5772b
`c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a`	affected	< 12cafc15d24611bfb43c82877b1bbb7454a85d5a
`c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a`	affected	< c8737d33d4e8ffae87e5d5edac17f8a705235cc2
`c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a`	affected	< b3fc99fe5b25613dd61c57bc70b8479adff4f60d
`c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a`	affected	< 2e8f53a7382943411557e370f1a4f3946624a30e
`c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a`	affected	< 8a8a3232abac5b972058a5f2cb3e33199d2a8648

Linux

affected

Version	Status	Constraints
`4.10`	affected	—
`0`	unaffected	< 4.10
`5.10.252`	unaffected	≤ 5.10.*
`5.15.202`	unaffected	≤ 5.15.*
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.16`	unaffected	≤ 6.18.*
`6.19.6`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a,9d9c67976eda502edc6b3a148a1c5b6a18b69a98)`	affected	code_commit	['*']
`[c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a,0bc43eaf021347f8d5aba87712c36b799695eec6)`	affected	code_commit	['*']
`[c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a,9d7962d5c81d6cf3f8dbdb5c71c57600bac5772b)`	affected	code_commit	['*']
`[c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a,2e8f53a7382943411557e370f1a4f3946624a30e)`	affected	code_commit	['*']
`[c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a,8a8a3232abac5b972058a5f2cb3e33199d2a8648)`	affected	code_commit	['*']
`[c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a,b3fc99fe5b25613dd61c57bc70b8479adff4f60d)`	affected	code_commit	['*']
`[c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a,12cafc15d24611bfb43c82877b1bbb7454a85d5a)`	affected	code_commit	['*']
`[c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a,c8737d33d4e8ffae87e5d5edac17f8a705235cc2)`	affected	code_commit	['*']

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.10.0`	affected	semver	['*']
`[0,4.10.0)`	unaffected	semver	['*']
`[5.10.252,5.11.0)`	unaffected	semver	['*']
`[5.15.202,5.16.0)`	unaffected	semver	['*']
`[6.1.165,6.2.0)`	unaffected	semver	['*']
`[6.6.128,6.7.0)`	unaffected	semver	['*']
`[6.12.75,6.13.0)`	unaffected	semver	['*']
`[6.18.16,6.19.0)`	unaffected	semver	['*']
`[6.19.6,7.0.0)`	unaffected	semver	['*']
`[7.0,*]`	unaffected	generic	['*']

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that contains the mtk-mdp probe error handling fixes (commits referenced in the CVE).
If updating is not immediately possible, blacklist or disable the MediaTek MDP driver to prevent it from loading.
Restrict kernel module loading rights to privileged users only to reduce the risk of an unintended probe trigger.

Generated by OpenCVE AI on May 8, 2026 at 20:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4606-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0bc43eaf021347f8d5aba87712c36b799695eec6
https://git.kernel.org/stable/c/12cafc15d24611bfb43c82877b1bbb7454a85d5a
https://git.kernel.org/stable/c/2e8f53a7382943411557e370f1a4f3946624a30e
https://git.kernel.org/stable/c/8a8a3232abac5b972058a5f2cb3e33199d2a8648
https://git.kernel.org/stable/c/9d7962d5c81d6cf3f8dbdb5c71c57600bac5772b
https://git.kernel.org/stable/c/9d9c67976eda502edc6b3a148a1c5b6a18b69a98
https://git.kernel.org/stable/c/b3fc99fe5b25613dd61c57bc70b8479adff4f60d
https://git.kernel.org/stable/c/c8737d33d4e8ffae87e5d5edac17f8a705235cc2
https://lore.kernel.org/linux-cve-announce/2026050648-CVE-2026-43207-d26b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43207
https://www.cve.org/CVERecord?id=CVE-2026-43207

History

Fri, 08 May 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-567

Fri, 08 May 2026 13:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 07 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026050648-CVE-2026-43207-d26b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43207 https://www.cve.org/CVERecord?id=CVE-2026-43207

Wed, 06 May 2026 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476 CWE-567

Wed, 06 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: media: mtk-mdp: Fix error handling in probe function Add mtk_mdp_unregister_m2m_device() on the error handling path to prevent resource leak. Add check for the return value of vpu_get_plat_device() to prevent null pointer dereference. And vpu_get_plat_device() increases the reference count of the returned platform device. Add platform_device_put() to prevent reference leak.
Title		media: mtk-mdp: Fix error handling in probe function
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0bc43eaf021347f8d5aba87712c36b799695eec6 https://git.kernel.org/stable/c/12cafc15d24611bfb43c82877b1bbb7454a85d5a https://git.kernel.org/stable/c/2e8f53a7382943411557e370f1a4f3946624a30e https://git.kernel.org/stable/c/8a8a3232abac5b972058a5f2cb3e33199d2a8648 https://git.kernel.org/stable/c/9d7962d5c81d6cf3f8dbdb5c71c57600bac5772b https://git.kernel.org/stable/c/9d9c67976eda502edc6b3a148a1c5b6a18b69a98 https://git.kernel.org/stable/c/b3fc99fe5b25613dd61c57bc70b8479adff4f60d https://git.kernel.org/stable/c/c8737d33d4e8ffae87e5d5edac17f8a705235cc2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-06T11:28:11.601Z

Updated: 2026-05-11T22:20:04.318Z

Reserved: 2026-05-01T14:12:55.993Z

Link: CVE-2026-43207

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-06T12:16:40.037

Modified: 2026-05-11T19:59:34.427

Link: CVE-2026-43207

Redhat

Severity :

Publid Date: 2026-05-06T00:00:00Z

Links: CVE-2026-43207 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-08T21:00:10Z

Weaknesses

CWE-476

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object