CVE-2026-89884: Linux Kernel mtk-mdp3 Use-After-Free Flaw

CVE-2026-89884 Overview

CVE-2026-89884 is a NULL pointer dereference vulnerability in the Linux kernel's MediaTek Media Data Path 3 (mtk-mdp3) media platform driver. The flaw exists in the driver's System Companion Processor (SCP) lookup path, where the returned pointer was used without a sanity check. If the SCP driver had not yet been bound, the pointer could be NULL and any subsequent dereference would trigger a kernel oops. The upstream fix adds the missing NULL check after the SCP lookup to prevent the dereference.

Critical Impact
Local triggering of the NULL dereference results in a kernel crash on affected MediaTek platforms, causing a denial of service condition.

Affected Products

Linux kernel drivers/media/platform/mediatek/mdp3 subsystem
Systems using the MediaTek MDP3 media platform driver with SCP
MediaTek SoC-based devices relying on mtk-mdp3 for media data path processing

Discovery Timeline

2026-09-16 - CVE-2026-89884 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89884

Vulnerability Analysis

The mtk-mdp3 driver coordinates with the MediaTek System Companion Processor (SCP) to offload media data path processing. During probe or initialization, the driver performs an SCP lookup to obtain a reference to the SCP device. The original code assumed the lookup would always succeed and proceeded to use the returned pointer directly. When the SCP driver has not yet been bound, the lookup returns NULL, and subsequent field access dereferences a NULL pointer. This condition results in a kernel oops on the affected code path, terminating the calling context and leaving the media pipeline in an unusable state. The bug is classified as a NULL Pointer Dereference [CWE-476].

Root Cause

The root cause is a missing sanity check on the pointer returned from the SCP lookup helper. The driver used the pointer immediately without validating it against NULL. Driver binding order on MediaTek platforms is not guaranteed, so the SCP driver may still be unbound when mtk-mdp3 attempts the lookup. The upstream patch adds the missing NULL check to defer or fail probe cleanly instead of dereferencing the NULL pointer.

Attack Vector

Triggering the condition requires local presence on a system running an affected kernel with the mtk-mdp3 driver loaded on MediaTek hardware. The trigger depends on the SCP driver not being bound at the time the media driver probes. There is no evidence of remote exploitation and no public proof-of-concept is referenced. The observable impact is a kernel crash on the affected path, not memory corruption or privilege escalation.

No verified code example is available. Refer to the upstream commits for the exact source-level change:

Detection Methods for CVE-2026-89884

Indicators of Compromise

Kernel oops or panic messages referencing mtk-mdp3 functions in dmesg or persistent kernel logs.
NULL pointer dereference stack traces originating from MediaTek MDP3 probe or initialization code paths.
Repeated failures to initialize the MediaTek media data path on device boot.

Detection Strategies

Inventory kernel versions across MediaTek-based Linux devices and compare against the fixed commits listed in the NVD references.
Parse journalctl -k and /var/log/kern.log for oops signatures containing mtk_mdp3 or mdp3_probe symbols.
Correlate unexpected reboots on MediaTek hardware with media subsystem initialization events.

Monitoring Recommendations

Forward kernel logs from affected embedded and edge devices to a centralized log store for pattern-based alerting on NULL dereference traces.
Monitor device uptime and probe failure counters on fleets running MediaTek SoCs.
Track kernel package versions through configuration management to confirm patched builds are deployed.

How to Mitigate CVE-2026-89884

Immediate Actions Required

Identify all Linux hosts and embedded devices running MediaTek SoCs with the mtk-mdp3 driver enabled.
Upgrade to a kernel release that includes one of the fix commits referenced by NVD.
Rebuild and redeploy custom kernels for embedded MediaTek products to include the SCP NULL check.

Patch Information

The fix adds a sanity check after the SCP lookup so the driver no longer dereferences a NULL pointer when the SCP driver is unbound. The change is available in the following upstream commits: 28548387d79d, 426ead7eed6d, 5026f927ef41, and 90368323fb24. Apply the stable kernel update corresponding to your distribution or vendor kernel branch.

Workarounds

If patching is not immediately possible, avoid loading the mtk-mdp3 module on systems where the SCP driver is not present or reliably bound.
Adjust driver load order or module dependencies to ensure the SCP driver binds before mtk-mdp3 probes.
Restrict local access on affected devices to reduce the ability to trigger the crash path.

bash

# Verify running kernel version and check for the mtk-mdp3 module
uname -r
lsmod | grep mtk_mdp3

# Temporarily prevent the vulnerable module from loading until patched
echo 'blacklist mtk_mdp3' | sudo tee /etc/modprobe.d/mtk-mdp3-blacklist.conf
sudo update-initramfs -u