PT-2026-117000

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the mtk drm bind function within the drm/mediatek component. When a device is not the mmsys master, the function takes a reference to the disp-mutex device usi...

PT-2026-128648

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix pdev reference leak in mtk drm bind When the device is not the mmsys master, mtk drm bind returns early after taking a reference on the disp-mutex device via of find device by node, without ever dropping it: mtk...

mtk_drm_drv Heap Buffer Overflow DoS

The vulnerability of the mtkdrmbind function in the drivers/gpu/drm/mediatek/mtkdrmdrv.c driver for the Direct Rendering Infrastructure DRI of Mediatek graphics cards in Linux operating systems is related to the reutilization of previously freed memory. Exploiting this vulnerability can allow an...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-387630)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-387630 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix a null pointer crash in mtkdrmcrtcfinishpageflip It's possible that mtkcrtc-eve...

SUSE CVE-2023-53534

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: mtkdrmcrtc: Add checks for devmkcalloc As the devmkcalloc may return NULL, the return value needs to be checked to avoid NULL poineter dereference...

CVE-2023-53534

Based on the UNPATCHED_CVE_2023_53534.NASL entry, CVE-2023-53534 affects the Linux kernel DRM/Mediatek path (mtk_drm_crtc). The root cause is a missing validation for devm_kcalloc return values, which may be NULL, risking NULL pointer dereference. The advisory notes that this vulnerability has be...

CVE-2023-53388 drm/mediatek: Clean dangling pointer on bind error path

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Clean dangling pointer on bind error path mtkdrmbind can fail, in which case drmdevput is called, destroying the drmdevice object. However a pointer to it was still being held in the private object, and that pointer...

PT-2025-3651

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description A use-after-free vulnerability has been resolved in the Linux kernel. The issue occurs in the drm/mediatek module when mtk drm bind returns an error, and the private-all drm privatei-drm pointe...

PT-2024-6497

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a resource management error in the drm/mediatek component of the Linux kernel. If a userspace application attempts to allocate a 0x0 GBM buffer, the kernel will...

PT-2024-28074

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the initialization of the ddp comp array in the Linux kernel's drm/mediatek module. When conn routes is true, an extra slot is allocated in the array, but it is n...

PT-2024-21550

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer crash has been fixed in the Linux kernel, specifically in the drm/mediatek module, related to the mtk drm crtc finish page flip function. The issue occurs when mtk...

PT-2023-36426

Уязвимость в модуле drivers/gpu/drm/mediatek/mtk drm crtc.c DRM драйвера Mediatek ядра операционной системы Linux связана с невалидным освобождением памяти. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информаци...

PT-2025-38367

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The mtk drm bind function may fail, leading to a dangling pointer within the private object. If a suspend operation is triggered after this failure, the pointer is passed to DRM via the...