CVE-2026-43207: Linux Kernel mtk-mdp Resource Leak Flaw

CVE-2026-43207 Overview

CVE-2026-43207 is a resource management vulnerability in the Linux kernel's MediaTek Media Data Path (mtk-mdp) media driver. The flaw resides in the driver's probe function, where the error handling path fails to call mtk_mdp_unregister_m2m_device(), resulting in a resource leak. The probe routine also fails to validate the return value of vpu_get_plat_device(), which can lead to a null pointer dereference. Additionally, vpu_get_plat_device() increments the reference count of the returned platform device, but the driver never calls platform_device_put(), producing a reference count leak.

Critical Impact

Faulty error handling in the mtk-mdp probe function can trigger a null pointer dereference and leak kernel resources on systems using MediaTek media hardware.

Affected Products

• Linux kernel versions containing the mtk-mdp media driver prior to the patched commits
• Systems using MediaTek Media Data Path (MDP) hardware with the affected driver
• Distributions shipping the unpatched stable Linux kernel branches

Discovery Timeline

• 2026-05-06 - CVE-2026-43207 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43207

Vulnerability Analysis

The vulnerability affects the mtk-mdp media driver, which provides image processing capabilities for MediaTek system-on-chip (SoC) platforms. The driver's probe function performs several initialization steps, including registering a memory-to-memory (m2m) device and acquiring a reference to the Video Processing Unit (VPU) platform device. When initialization steps fail downstream, the existing error handling path does not properly unwind earlier successful operations.

Three distinct issues were addressed in the fix. First, the error path omitted a call to mtk_mdp_unregister_m2m_device(), leaving the registered m2m device dangling on failure. Second, the driver dereferenced the pointer returned by vpu_get_plat_device() without verifying it was non-null. Third, because vpu_get_plat_device() increments the platform device reference count, the absence of platform_device_put() produced a reference count leak even on success-adjacent paths.

Root Cause

The root cause is incomplete error handling in the mtk-mdp probe function combined with missing input validation on a returned pointer. Kernel driver probe routines must release every resource acquired earlier in the function when a later step fails, and must validate pointers returned by helper APIs before use.

Attack Vector

This is a local kernel driver flaw triggered during device initialization on MediaTek hardware. An attacker would require the affected hardware path to be exercised with conditions that cause probe-time failures. The primary impact is denial of service through null pointer dereference and gradual resource exhaustion from leaked references.

No verified exploitation code is available. Technical details for each fix are available in the upstream commits, including commit 0bc43eaf and commit 9d9c6797.

Detection Methods for CVE-2026-43207

Indicators of Compromise

• Kernel oops or panic messages referencing mtk_mdp_probe or vpu_get_plat_device in dmesg output
• Repeated probe failures for the mtk-mdp driver during boot or module load
• Increasing platform device reference counts visible in /sys/bus/platform/devices/ for VPU devices over time

Detection Strategies

• Audit installed kernel versions across MediaTek-based Linux systems and compare against the patched stable commits
• Monitor kernel logs for null pointer dereference signatures originating in MediaTek media driver code paths
• Use kernel sanitizers such as KASAN and kmemleak in test environments to surface the leak before production deployment

Monitoring Recommendations

• Centralize kernel log collection and alert on BUG:, Oops:, or general protection fault entries containing mtk_mdp symbols
• Track kernel package versions through configuration management to confirm patch deployment status
• Inventory devices that load the mtk-mdp module and prioritize them for remediation

How to Mitigate CVE-2026-43207

Immediate Actions Required

• Update to a Linux stable kernel release containing the fix commits referenced in the upstream advisory
• Identify all systems running MediaTek SoCs that load the mtk-mdp kernel module and schedule remediation
• Validate the patch is applied by checking the running kernel version against the fixed stable branches

Patch Information

The Linux kernel maintainers resolved the issue across multiple stable branches. The fix adds mtk_mdp_unregister_m2m_device() to the error handling path, validates the return value of vpu_get_plat_device(), and adds platform_device_put() to release the platform device reference. Patch commits are tracked at git.kernel.org commit b3fc99fe and git.kernel.org commit c8737d33, among others.

Workarounds

• Blacklist the mtk-mdp kernel module on systems that do not require MediaTek media data path functionality
• Restrict physical and local access to affected MediaTek devices until patches are deployed
• Apply distribution vendor kernel updates as soon as they incorporate the upstream stable fixes

# Blacklist the mtk-mdp module until the patched kernel is deployed
echo "blacklist mtk-mdp" | sudo tee /etc/modprobe.d/blacklist-mtk-mdp.conf
sudo update-initramfs -u
sudo reboot