SB20261022392 - Missing Release of Resource after Effective Lifetime in Linux kernel drm mediatek driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022392

SB20261022392 - Missing Release of Resource after Effective Lifetime in Linux kernel drm mediatek driver

Published: October 22, 2026

Security Bulletin ID SB20261022392
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98782)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to leak kernel resources, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to missing release of a registered OVL adaptor platform device in the MediaTek DRM driver when initialization fails after device registration or the driver is unbound. A local privileged user can trigger these driver lifecycle operations, where permitted, to leave platform devices registered and potentially exhaust system resources.

The affected device is created only when the display pipeline requires the OVL adaptor.


Remediation

Install update from vendor's website.

References