CVE-2026-43270

Vulnerability

Description

In the Linux kernel's MediaTek MDP (Media Data Path) driver, the mtk_mdp_remove() function fails to properly release a reference count. During driver initialization (mtk_mdp_probe()), the function vpu_get_plat_device() is called, which increments the reference count of the returned platform device. However, the corresponding platform_device_put() call is missing in the removal path, leading to a reference leak [1][2].

Root

Cause and Exploitation

The root cause is a missing decrement of the device reference count in the driver's remove callback. This is a classic reference leak bug that occurs when the driver is unloaded or when the device is removed. No special privileges or network access are required; the vulnerability is triggered by normal driver lifecycle operations, such as module unloading or device unbinding.

Impact

An attacker with the ability to trigger driver removal (e.g., by physically removing the device or by unloading the kernel module) can cause the reference count to leak. Over repeated removal cycles, this can lead to memory exhaustion, denial of service, or system instability. The CVSS v3 score of 5.5 (Medium) reflects the local nature and the potential for resource exhaustion.

Mitigation

The fix adds a call to platform_device_put() in mtk_mdp_remove() to balance the reference count. The patch has been applied to the Linux kernel stable tree [3][4]. Users should update to a kernel version containing this fix to prevent the leak.