CVE-2026-98782

Received Received - Intake

Platform Device Leak in Linux Kernel DRM/MTK

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix ovl adaptor platform device leak mtk_drm_probe() creates an OVL adaptor platform device with platform_device_register_data() when the display pipeline requires the OVL adaptor. If a later initialization step fails, the probe error path releases the DRM resources without unregistering the already registered OVL adaptor device. The normal remove path likewise leaves the device registered after the DRM driver is unbound. Keep track of whether the OVL adaptor was successfully registered and unregister it on probe failure. Also recover the platform device from the stored DDP component device and unregister it during normal removal. The issue was identified by a static analysis tool I developed and confirmed by manual review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98782

EUVD

EUVD-2026-103867

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	0d9eee9118b77e51eeafc5bf4d008fac97035d56
Linux	Linux	0d9eee9118b77e51eeafc5bf4d008fac97035d56
Linux	Linux	0d9eee9118b77e51eeafc5bf4d008fac97035d56
Linux	Linux	0d9eee9118b77e51eeafc5bf4d008fac97035d56
Linux	Linux	6.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a platform device leak in the DRM/MediaTek display driver. When initializing the display pipeline, the system creates an OVL adaptor platform device. If later initialization fails, the error handling does not properly unregister this device, leaving it registered even after the DRM driver is removed. This can lead to resource leaks and potential system instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/mediatek driver and relates to a platform device leak in the OVL adaptor. Detection requires checking kernel logs for errors during display driver initialization or removal, particularly around mtk_drm_probe() and related cleanup paths.

Impact Analysis

This vulnerability may cause resource leaks in the Linux kernel, potentially leading to system instability or crashes. It could affect systems using MediaTek display hardware, causing display-related issues or performance degradation over time due to unmanaged device registrations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. It is a Linux kernel driver issue related to resource leaks in the display pipeline, not a data privacy or security breach.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the mtk_drm_probe() OVL adaptor device leak. Monitor kernel logs for display driver errors during boot or shutdown.

Hi! I’m here to help you understand CVE-2026-98782. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70