CVE-2026-89885media: platform: mtk-mdp3: Fix SCP device refcounting
- 8.4HighCVSS base score
- 0.20%Exploitation in 30 daysEPSS · top 91% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: Fix SCP device refcounting mdp_probe() first tries to get the SCP handle with scp_get(). When that fails, it falls back to looking up the SCP platform device with __get_pdev_by_id() and then reads its driver data. The fallback lookup returns the platform device with a reference, just like scp_get() does. However, the fallback path currently drops that reference immediately after platform_get_drvdata(). The driver later still calls scp_put(mdp->scp) unconditionally from the probe error path and from mdp_video_device_release(), which drops the SCP device reference again. Keep the fallback reference until the existing scp_put() call, so that the fallback path follows the same ownership rules as the scp_get() path.
Timeline
ID reserved
By Linux
- 5 days later
· 5 days later
Published
- 33 days later
· 33 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.20% · top 91% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.
Affected products
- affected db4d27e6bbbf511f9cdb33f682535a0a3cb7c403 – < dce13bd9bade3ecc1acb7579397f24743850997f
- affected 31ba1a4d7a5d9466f6ef4910a372b8200f8aad19 – < 252850653569fdb1a259937e02325cf32c8f0970
- affected 8f6f3aa21517ef34d50808af0c572e69580dca20 – < 0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f
- affected 8f6f3aa21517ef34d50808af0c572e69580dca20 – < 55793e4665b7f15151e6f5ab51ca980e73abed5d
- affected 6.12.64 – < 6.12.110
- affected 6.18.4 – < 6.18.51
- affected 6.19
- unaffected < 6.19
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.51 – ≤ 6.18.*
- unaffected 7.2.5 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References4
- https://git.kernel.org/stable/c/dce13bd9bade3ecc1acb7579397f24743850997f (opens in a new tab)
- https://git.kernel.org/stable/c/252850653569fdb1a259937e02325cf32c8f0970 (opens in a new tab)
- https://git.kernel.org/stable/c/0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f (opens in a new tab)
- https://git.kernel.org/stable/c/55793e4665b7f15151e6f5ab51ca980e73abed5d (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-80485 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89885)Record last updated .