CVE-2026-43207
Resource Leak in Linux Kernel Media Driver
Publication date: 2026-05-06
Last updated on: 2026-05-11
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.2 (inc) to 6.6.128 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.75 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.16 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.6 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.202 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.165 (exc) |
| linux | linux_kernel | From 4.10 (inc) to 5.10.252 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the mtk-mdp media component. The fix involves proper error handling in the probe function to prevent resource leaks and null pointer dereferences.
- Apply the patch or upgrade to the kernel version released after 2026-05-06 that contains the fix.
- Ensure that the mtk_mdp_unregister_m2m_device() function is called on error paths to prevent resource leaks.
- Verify that the return value of vpu_get_plat_device() is checked to avoid null pointer dereferences.
- Confirm that platform_device_put() is used appropriately to prevent reference leaks.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's media component, specifically in the mtk-mdp driver. It involves improper error handling in the probe function, where certain cleanup functions were not called on error paths. This could lead to resource leaks and null pointer dereferences due to missing checks and missing calls to release resources.
How can this vulnerability impact me? :
The vulnerability can cause resource leaks and null pointer dereferences in the Linux kernel's media driver. Resource leaks may degrade system performance or stability over time, while null pointer dereferences can lead to kernel crashes or system instability.