CVE-2026-89885 Overview
CVE-2026-89885 is a reference-counting flaw in the Linux kernel's MediaTek Media Data Path 3 (MDP3) platform driver (drivers/media/platform/mediatek/mdp3). The mdp_probe() function mishandles the System Companion Processor (SCP) device reference when it falls back from scp_get() to __get_pdev_by_id(). The fallback path drops the platform device reference immediately after calling platform_get_drvdata(), while later code paths still invoke scp_put() on the same device. The unbalanced reference count can lead to a use-after-free on the SCP device structure.
Critical Impact
Local users on affected MediaTek-based Linux systems can trigger memory corruption through the MDP3 driver, potentially enabling privilege escalation or kernel denial of service.
Affected Products
- Linux kernel builds containing the mtk-mdp3 media platform driver
- MediaTek SoC-based devices using the Media Data Path 3 (MDP3) subsystem
- Distributions shipping vulnerable stable kernel branches prior to the fix commits
Discovery Timeline
- 2026-09-16 - CVE-2026-89885 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89885
Vulnerability Analysis
The vulnerability resides in the probe routine of the MediaTek MDP3 media platform driver. During initialization, mdp_probe() attempts to acquire a handle to the SCP through scp_get(). When that call fails, the driver falls back to locating the SCP platform device via __get_pdev_by_id() and retrieves its driver data with platform_get_drvdata().
Both scp_get() and __get_pdev_by_id() return the platform device with an incremented reference. However, the fallback path releases that reference immediately after reading the driver data. Later cleanup code in the probe error path and in mdp_video_device_release() still calls scp_put(mdp->scp) unconditionally, dropping the reference a second time.
The result is an unbalanced refcount on the SCP device. When the underlying struct device is prematurely released, subsequent driver operations reference freed memory, producing a use-after-free condition in kernel space [CWE-416 class behavior].
Root Cause
The root cause is inconsistent ownership semantics between the two lookup paths in mdp_probe(). The scp_get() path retains the device reference until scp_put() releases it. The __get_pdev_by_id() fallback drops the reference early, breaking the invariant that mdp->scp holds a reference for the driver's lifetime.
Attack Vector
Exploitation requires local access to a system running an affected kernel on MediaTek hardware exposing the MDP3 device. An attacker with the ability to trigger probe failure conditions or induce driver teardown can force the double-put on the SCP device reference. Successful exploitation corrupts kernel memory management structures and can be leveraged for privilege escalation or a kernel crash.
The vulnerability requires no user interaction and no privileges beyond local access, and it impacts confidentiality, integrity, and availability of the kernel.
No public proof-of-concept exploit is available. See the upstream fix commits for technical details: Kernel Git Commit 0259ade, Kernel Git Commit 25285065, Kernel Git Commit 55793e46, and Kernel Git Commit dce13bd9.
Detection Methods for CVE-2026-89885
Indicators of Compromise
- Kernel oops or panic messages referencing mdp_probe, mdp_video_device_release, or scp_put in dmesg output.
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free access on SCP platform device structures.
- Unexpected driver rebind failures or repeated probe errors from the mtk-mdp3 driver on MediaTek platforms.
Detection Strategies
- Inventory running kernel versions across MediaTek-based fleets and correlate against the fix commits referenced in the upstream advisories.
- Enable KASAN and refcount debugging (CONFIG_REFCOUNT_FULL, CONFIG_DEBUG_KOBJECT_RELEASE) in test builds to surface refcount imbalances early.
- Review kernel logs for refcount_t: underflow warnings tied to the SCP or MDP3 subsystems.
Monitoring Recommendations
- Forward kernel logs and crash telemetry from Linux endpoints to a centralized logging platform for anomaly detection.
- Alert on repeated driver probe failures on MediaTek media pipelines that could indicate exploitation attempts.
- Track kernel package versions across managed devices to confirm patch deployment status.
How to Mitigate CVE-2026-89885
Immediate Actions Required
- Apply the upstream Linux stable kernel updates that incorporate the SCP refcounting fix.
- Rebuild and redeploy custom kernels for MediaTek-based devices, ensuring the corrected mdp_probe() logic is included.
- Restrict local access to affected devices until patched kernels are installed.
Patch Information
The fix keeps the fallback reference alive until the existing scp_put() call, aligning both lookup paths with the same ownership rules. Fixes are available in the following upstream commits: 0259ade4c4ce, 252850653569, 55793e4665b7, and dce13bd9bade.
Workarounds
- Blacklist the mtk-mdp3 kernel module on systems that do not require MediaTek MDP3 media functionality.
- Limit privileged local access and enforce least-privilege user configurations on affected devices.
- Deploy stricter access controls on media device nodes to reduce the attack surface until patches are applied.
# Blacklist the vulnerable module until the kernel is patched
echo "blacklist mtk-mdp3" | sudo tee /etc/modprobe.d/blacklist-mtk-mdp3.conf
sudo update-initramfs -u
sudo reboot
# Verify installed kernel version after patching
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
