CVE-2026-98782
Received
Received - Intake
Platform Device Leak in Linux Kernel DRM/MTK
Vulnerability report for CVE-2026-98782, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: Fix ovl adaptor platform device leak
mtk_drm_probe() creates an OVL adaptor platform device with
platform_device_register_data() when the display pipeline requires the
OVL adaptor.
If a later initialization step fails, the probe error path releases
the DRM resources without unregistering the already registered OVL
adaptor device. The normal remove path likewise leaves the device
registered after the DRM driver is unbound.
Keep track of whether the OVL adaptor was successfully registered and
unregister it on probe failure. Also recover the platform device from
the stored DDP component device and unregister it during normal
removal.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 0d9eee9118b77e51eeafc5bf4d008fac97035d56 |
| Linux | Linux | 0d9eee9118b77e51eeafc5bf4d008fac97035d56 |
| Linux | Linux | 0d9eee9118b77e51eeafc5bf4d008fac97035d56 |
| Linux | Linux | 0d9eee9118b77e51eeafc5bf4d008fac97035d56 |
| Linux | Linux | 6.4 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
