medium · CVSS v3 5.5

CVE-2026-98783

A missing error check in the Mediatek DRM driver can cause the Linux kernel to crash when registering a platform device. The flaw arises fro

Overview

A missing error check in the Mediatek DRM driver can cause the Linux kernel to crash when registering a platform device. The flaw arises from using an ERR_PTR value without validation, leading to an invalid pointer passed to component_match_add(). This results in a kernel panic on affected systems.

Description

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device platform_device_register_data() can fail and return an ERR_PTR, but the return value is used without checking, leading to an invalid pointer being stored in ddp_comp[].dev and passed to component_match_add() and mtk_ddp_comp_init(), which could result in a kernel crash. Add an IS_ERR() check to jump to the error handling path on failure.

Impact

Availability: the kernel may crash, causing a system reboot or service interruption. Integrity is not directly compromised, but the crash could allow denial of service. Confidentiality remains unaffected. Defenders should consider this a moderate risk to uptime.

Remediation

Apply the vendor-supplied patch that adds an IS_ERR() check before using the return value of platform_device_register_data(). Update to the latest kernel release that includes this fix. Verify that component_match_add() is not called with an ERR_PTR. If unable to patch immediately, isolate affected devices or restrict GPU usage until patched.

Risk context

The CVSS v3 score of 5.5 indicates medium severity. No EPSS data is available, so the urgency is moderate; defenders should prioritize patching in environments where uptime is critical.

Affected products

  • Linux kernel
  • Mediatek DRM driver

Scores

Severity
medium
CVSS v2
4.9
CVSS v3
5.5
CVSS v4
—
EPSS
—

kernel drm mediatek crash availability missing-check linux

← All CVEs

Related CVEs

medium

CVE-2026-98723

In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pc_refs Commit 6202783184bf ("nvmet: Improve nvmet_alloc_ctrl() interface and implementation") added a second uuid_copy() of args->hostid near the end of nvmet_alloc_ctrl(), and commit 7b658153f1b8 ("nvmet: Remove duplicate uuid_copy") removed the original copy that sat before nvmet_ctrl_init_pr() instead of the new one. Since then nvmet_ctrl_init_pr() snapshots ctrl->hostid into the per-controller per-namespace reservation refs while the uuid_copy() from the connect data runs later, after the controller is published. The ctrl is allocated with kzalloc(), so every pc_ref created on this path stores the nil UUID. pc_ref->hostid has a single consumer: nvmet_pr_set_ctrl_to_abort() matches it against the preempted registrant's hostid to kill and drain the victim's in-flight I/O for Preempt and Abort. The match can never hit with the nil UUID, so whenever a namespace with reservations enabled exists before a host connects, which includes every reconnect, Preempt and Abort silently degrades into a plain Preempt: the preempting host sees success while the victim's in-flight I/O is still in the air. Copy the hostid where the rest of the connect data is consumed, before the controller is published and before nvmet_ctrl_init_pr() takes its snapshot.

View analysis

medium

CVE-2026-98676

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration ade9000_setup_clkout() passes NULL as the register address when registering a divider clock. During clock registration, the common clock framework calls clk_divider_recalc_rate(), which dereferences the address through readl(). As a result, probing an ADE9000 configured as a clock provider with an external input clock crashes. CLKOUT passes CLKIN through without changing its rate. Register it as a 1:1 fixed-factor clock, which does not require register access. This change does not affect the configuration using the internal clock, for which the driver does not register a clock provider.

View analysis

medium

CVE-2026-98678

A Linux kernel iio ADC driver for the AD4030 had an input validation flaw that allowed zero or negative oversampling ratios to be processed, potentially causing undefined behavior. The issue was fixed by validating the value before computing its logarithm. This matters because it could lead to kernel instability or incorrect ADC data on affected systems.

View analysis

medium

CVE-2026-98680

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022a_fifo_enable() at the buffer enable path, the allocated memory is never freed. Furthermore, the state information and previous hardware configuration(s) aren't undone, potentially leaving WMI interrupts and buffers enabled, or driver state flags wrong. Free the memory and revert the hardware configuration and state flags on error path.

View analysis