CVE-2026-43270: Linux Kernel Reference Leak Vulnerability

CVE-2026-43270 Overview

CVE-2026-43270 is a reference leak vulnerability in the Linux kernel's MediaTek Media Data Path (mtk-mdp) media driver. The flaw resides in the mtk_mdp_remove() function. During probe, mtk_mdp_probe() calls vpu_get_plat_device(), which increments the reference count of the returned platform device. The driver did not call platform_device_put() to release the reference, leaving a leaked refcount on the platform device structure.

The Linux kernel maintainers resolved the issue by adding the missing platform_device_put() call to balance the reference acquired during probe.

Critical Impact
A leaked platform device reference in the mtk-mdp driver prevents proper cleanup on module removal, leading to resource retention in kernel memory on affected MediaTek-based Linux systems.

Affected Products

Linux kernel media/mtk-mdp driver subsystem
MediaTek SoC platforms relying on the MDP video processing driver
Linux stable trees prior to the patch commits referenced in the kernel.org stable repository

Discovery Timeline

2026-05-06 - CVE-2026-43270 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43270

Vulnerability Analysis

The MediaTek MDP driver provides image and video processing acceleration on MediaTek SoCs. During driver initialization, mtk_mdp_probe() retrieves the Video Processor Unit (VPU) platform device by calling vpu_get_plat_device(). This helper increases the reference count on the returned struct platform_device to ensure the device remains valid while the MDP driver holds a pointer to it.

The mtk_mdp_remove() function did not release this reference during driver teardown. Each probe and remove cycle therefore left an unbalanced reference on the VPU platform device. Over time, this refcount imbalance prevents the kernel from freeing the underlying device structure and any associated resources.

Root Cause

The root cause is a missing call to platform_device_put() in the driver's removal path. The kernel's reference counting model requires that every *_get() operation be paired with a corresponding *_put(). The fix introduces the missing platform_device_put() invocation in mtk_mdp_remove() so the reference acquired in probe is released on teardown.

Attack Vector

This is a kernel resource management defect rather than a directly exploitable memory corruption issue. Triggering the leak requires repeated load and unload cycles of the mtk-mdp driver on a MediaTek platform. Local users with the ability to bind and unbind the driver, or repeatedly load and unload the kernel module, can induce gradual kernel memory pressure on affected systems.

The vulnerability is described in prose only; technical specifics are documented in the upstream commits referenced below. See the Linux Kernel Commit f128bab and Linux Kernel Commit 4f2a514 for the patch sources.

Detection Methods for CVE-2026-43270

Indicators of Compromise

Persistent references to the MediaTek VPU platform device that are not released after mtk-mdp module removal
Growth in kernel slab allocations associated with platform_device objects on MediaTek hardware after repeated driver bind/unbind cycles
Kernel log entries showing successful mtk_mdp_probe() and mtk_mdp_remove() events without corresponding device release

Detection Strategies

Audit running kernel versions on MediaTek-based Linux endpoints and compare against the patched stable releases referenced in the kernel.org commits
Inspect /sys/bus/platform/devices/ and refcount data in /sys/kernel/debug/ to identify lingering VPU device references after driver unload
Use kmemleak and slab accounting tools to flag growing platform device allocations during repeated module load and unload tests

Monitoring Recommendations

Monitor kernel module load and unload events for the mtk-mdp driver via auditd rules targeting init_module and delete_module syscalls
Track long-running MediaTek systems for steady kernel memory growth that correlates with media driver lifecycle activity
Centralize kernel logs and audit data in a SIEM for trend analysis across fleets of MediaTek-based devices

How to Mitigate CVE-2026-43270

Immediate Actions Required

Identify Linux systems running MediaTek SoCs that load the mtk-mdp driver
Apply the upstream Linux kernel patches that add platform_device_put() to mtk_mdp_remove()
Avoid repeated bind/unbind or module reload cycles of mtk-mdp on unpatched systems until the fix is deployed

Patch Information

The fix is distributed across multiple stable kernel branches. Refer to the upstream commits: Linux Kernel Commit 2d93758, Linux Kernel Commit 403b7c7, Linux Kernel Commit 4f2a514, Linux Kernel Commit 564fd3a, Linux Kernel Commit a62ba5a, Linux Kernel Commit c44beed, Linux Kernel Commit dd530e2, and Linux Kernel Commit f128bab. Update to the corresponding patched stable kernel from your distribution.

Workarounds

Restrict permissions to load and unload the mtk-mdp kernel module to trusted administrators only
Reboot affected systems periodically to reset accumulated leaked references until the patched kernel is installed
Where possible, blacklist the mtk-mdp module on systems that do not require MediaTek MDP video processing functionality

bash

# Verify running kernel version against patched stable releases
uname -r

# List loaded MediaTek media driver and inspect refcount
lsmod | grep mtk_mdp

# Restrict module load/unload to root only (already default; verify)
ls -l /sbin/insmod /sbin/rmmod /sbin/modprobe