---
id: CVE-2026-89885
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: platform: mtk-mdp3: Fix SCP device refcounting

  mdp_probe() first tries to get the SCP handle with scp_get()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: platform: mtk-mdp3: Fix SCP device refcounting

  mdp_probe() first tries to get the SCP handle with scp_get(). When that
  fails, it falls back to looking up the SC…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= db4d27e6bbbf511f9cdb33f682535a0a3cb7c403 <
    dce13bd9bade3ecc1acb7579397f24743850997f
  - >-
    Linux >= 31ba1a4d7a5d9466f6ef4910a372b8200f8aad19 <
    252850653569fdb1a259937e02325cf32c8f0970
  - >-
    Linux >= 8f6f3aa21517ef34d50808af0c572e69580dca20 <
    0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f
  - >-
    Linux >= 8f6f3aa21517ef34d50808af0c572e69580dca20 <
    55793e4665b7f15151e6f5ab51ca980e73abed5d
  - Linux >= 6.12.64 < 6.12.110
  - Linux >= 6.18.4 < 6.18.51
  - Linux 6.19
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:15.090'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89885'
references:
  - url: 'https://git.kernel.org/stable/c/0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/252850653569fdb1a259937e02325cf32c8f0970'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/55793e4665b7f15151e6f5ab51ca980e73abed5d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dce13bd9bade3ecc1acb7579397f24743850997f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.983Z'
epss: 0.00196
epssPercentile: 0.082
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: platform: mtk-mdp3: Fix SCP device refcounting

mdp_probe() first tries to get the SCP handle with scp_get(). When that
fails, it falls back to looking up the SCP platform device with
__get_pdev_by_id() and then reads its driver data.

The fallback lookup returns the platform device with a reference, just
like scp_get() does. However, the fallback path currently drops that
reference immediately after platform_get_drvdata(). The driver later
still calls scp_put(mdp->scp) unconditionally from the probe error path
and from mdp_video_device_release(), which drops the SCP device
reference again.

Keep the fallback reference until the existing scp_put() call, so that
the fallback path follows the same ownership rules as the scp_get()
path.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.