CVE-2026-89885

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the mtk-mdp3 platform media component regarding SCP device reference counting. The mdp probe() function attempts to obtain an SCP handle using scp get(). If this fails, it uses get pdev by id() as a fallback to look up the SCP platform device. While both methods return the device with a reference, the fallback path incorrectly drops this reference immediately after calling platform get drvdata(). Subsequently, the driver calls scp put() during the probe error path or within mdp video device release(), leading to a second reference drop for the same device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.