CVE-2026-89884 media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup

Not scored Published 16 Sep 2026 Updated 21 Oct 2026

A missing sanity check in the Linux kernel MTK MDP3 driver allows a local attacker to cause a denial of service via NULL pointer dereference.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-89884?

CVE-2026-89884 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup

Add the missing sanity check after looking up the SCP to avoid dereferencing a NULL-pointer in case its driver has not yet been bound.

Which versions are affected by CVE-2026-89884?

How do I fix CVE-2026-89884?

Apply the vendor's patch.

Is CVE-2026-89884 being exploited?

There is no known exploitation of CVE-2026-89884 in the wild and no public exploit code.

Sources

Also known as AZL-101184, BELL-CVE-2026-89884, DEBIAN-CVE-2026-89884, GHSA-c85x-5px9-87ph, UBUNTU-CVE-2026-89884.