CVE-2025-71140

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s media subsystem, specifically within the MediaTek vcodec component. A previous implementation used a mutex to protect encoder and decoder context lists from modifications originating from the SCP IP block, which could lead to a NULL pointer dereference in the IPI handler. The issue occurs because the VPU IPI handler is called from a hard IRQ context, triggering a scheduler warning. This was initially reported in ChromeOS kernels and is reproducible on mainline kernels using Fluster with FFmpeg v4l2m2m decoders. The problem is triggered even when the capture format is unsupported. The lock protects the context list and operations on it are fast, so switching to a spinlock resolves the issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.