CVE-2026-89884 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved:

media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup

Add the missing sanity check after looking up the SCP to avoid
dereferencing a NULL-pointer in case its driver has not yet been bound.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux Subscribe	Linux Kernel Subscribe

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://git.kernel.org/stable/c/28548387d79d14c975e77787ebd1f051265e1396
https://git.kernel.org/stable/c/426ead7eed6d6b3c3f0fe0925c112ef73fc87256
https://git.kernel.org/stable/c/5026f927ef4150ba12da6f1098cf7952d77b14b6
https://git.kernel.org/stable/c/90368323fb244da0504e3da37a182f8e89bcc3b9

History

Wed, 16 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Add the missing sanity check after looking up the SCP to avoid dereferencing a NULL-pointer in case its driver has not yet been bound.
Title		media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/28548387d79d14c975e77787ebd1f051265e1396 https://git.kernel.org/stable/c/426ead7eed6d6b3c3f0fe0925c112ef73fc87256 https://git.kernel.org/stable/c/5026f927ef4150ba12da6f1098cf7952d77b14b6 https://git.kernel.org/stable/c/90368323fb244da0504e3da37a182f8e89bcc3b9

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T10:31:49.063Z

Updated: 2026-09-16T10:31:49.063Z

Reserved: 2026-09-11T19:38:34.773Z

Link: CVE-2026-89884

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T11:16:56.877

Modified: 2026-09-16T11:16:56.877

Link: CVE-2026-89884

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89884", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.773Z", "datePublished": "2026-09-16T10:31:49.063Z", "dateUpdated": "2026-09-16T10:31:49.063Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-16T10:31:49.063Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: platform: mtk-mdp3: fix NULL deref on failed SCP lookup\n\nAdd the missing sanity check after looking up the SCP to avoid\ndereferencing a NULL-pointer in case its driver has not yet been bound."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c"], "versions": [{"version": "61890ccaefaff89f5babd2c8412fd222c3f5fe38", "lessThan": "28548387d79d14c975e77787ebd1f051265e1396", "status": "affected", "versionType": "git"}, {"version": "61890ccaefaff89f5babd2c8412fd222c3f5fe38", "lessThan": "5026f927ef4150ba12da6f1098cf7952d77b14b6", "status": "affected", "versionType": "git"}, {"version": "61890ccaefaff89f5babd2c8412fd222c3f5fe38", "lessThan": "426ead7eed6d6b3c3f0fe0925c112ef73fc87256", "status": "affected", "versionType": "git"}, {"version": "61890ccaefaff89f5babd2c8412fd222c3f5fe38", "lessThan": "90368323fb244da0504e3da37a182f8e89bcc3b9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/28548387d79d14c975e77787ebd1f051265e1396"}, {"url": "https://git.kernel.org/stable/c/5026f927ef4150ba12da6f1098cf7952d77b14b6"}, {"url": "https://git.kernel.org/stable/c/426ead7eed6d6b3c3f0fe0925c112ef73fc87256"}, {"url": "https://git.kernel.org/stable/c/90368323fb244da0504e3da37a182f8e89bcc3b9"}], "title": "media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "28548387d79d14c975e77787ebd1f051265e1396", "status": "affected", "version": "61890ccaefaff89f5babd2c8412fd222c3f5fe38", "versionType": "git"}, {"lessThan": "5026f927ef4150ba12da6f1098cf7952d77b14b6", "status": "affected", "version": "61890ccaefaff89f5babd2c8412fd222c3f5fe38", "versionType": "git"}, {"lessThan": "426ead7eed6d6b3c3f0fe0925c112ef73fc87256", "status": "affected", "version": "61890ccaefaff89f5babd2c8412fd222c3f5fe38", "versionType": "git"}, {"lessThan": "90368323fb244da0504e3da37a182f8e89bcc3b9", "status": "affected", "version": "61890ccaefaff89f5babd2c8412fd222c3f5fe38", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: platform: mtk-mdp3: fix NULL deref on failed SCP lookup\n\nAdd the missing sanity check after looking up the SCP to avoid\ndereferencing a NULL-pointer in case its driver has not yet been bound."}], "id": "CVE-2026-89884", "lastModified": "2026-09-16T11:16:56.877", "metrics": {}, "published": "2026-09-16T11:16:56.877", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/28548387d79d14c975e77787ebd1f051265e1396"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/426ead7eed6d6b3c3f0fe0925c112ef73fc87256"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5026f927ef4150ba12da6f1098cf7952d77b14b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/90368323fb244da0504e3da37a182f8e89bcc3b9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}