In the Linux kernel, the following vulnerability has been resolved:
media: mediatek: vcodec: Fix oops when HEVC init fails
The stateless HEVC decoder saves the instance pointer in the context regardless if the initialization worked or not. This caused a use after free, when the pointer is freed in case of a failure in the deinit function. Only store the instance pointer when the initialization was successful, to solve this issue.
Hardware name: Acer Tomato (rev3 - 4) board (DT) pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] lr : vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] sp : ffff80008750bc20 x29: ffff80008750bc20 x28: ffff1299f6d70000 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: ffff80008750bc98 x22: 000000000000a003 x21: ffffd45c4cfae000 x20: 0000000000000010 x19: ffff1299fd668310 x18: 000000000000001a x17: 000000040044ffff x16: ffffd45cb15dc648 x15: 0000000000000000 x14: ffff1299c08da1c0 x13: ffffd45cb1f87a10 x12: ffffd45cb2f5fe80 x11: 0000000000000001 x10: 0000000000001b30 x9 : ffffd45c4d12b488 x8 : 1fffe25339380d81 x7 : 0000000000000001 x6 : ffff1299c9c06c00 x5 : 0000000000000132 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000010 x1 : ffff80008750bc98 x0 : 0000000000000000 Call trace: vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] vpu_dec_deinit+0x1c/0x30 [mtk_vcodec_dec] vdec_hevc_slice_deinit+0x30/0x98 [mtk_vcodec_dec] vdec_if_deinit+0x38/0x68 [mtk_vcodec_dec] mtk_vcodec_dec_release+0x20/0x40 [mtk_vcodec_dec] fops_vcodec_release+0x64/0x118 [mtk_vcodec_dec] v4l2_release+0x7c/0x100 __fput+0x80/0x2d8 __fput_sync+0x58/0x70 __arm64_sys_close+0x40/0x90 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x38/0xd8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x1a8/0x1b0 Code: d503201f f9401660 b900127f b900227f (f9400400)
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Suse | — | Upgrade kernel-debug-livepatch-develUpgrade dtb-mediatekUpgrade kernel-default-livepatchUpgrade kernel-syms-rtUpgrade kernel-debug-develUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-optionalUpgrade kernel-64kbUpgrade kernel-default-develUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-syms-azureUpgrade kernel-docs-htmlUpgrade kernel-azure-livepatch-develUpgrade kernel-debugUpgrade kernel-develUpgrade dtb-amlogicUpgrade dtb-marvellUpgrade dtb-apmUpgrade kernel-default-extraUpgrade kernel-devel-azureUpgrade dtb-alteraUpgrade dtb-broadcomUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade dtb-appleUpgrade kernel-rt_debug-vdsoUpgrade dtb-lgUpgrade kernel-64kb-develUpgrade kernel-rt_debugUpgrade kernel-obs-qaUpgrade reiserfs-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-default-optionalUpgrade kselftests-kmp-64kbUpgrade dtb-xilinxUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-default-vdsoUpgrade dtb-amdUpgrade kernel-rt-livepatch-develUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade kernel-devel-rtUpgrade kernel-azure-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-azure-optionalUpgrade kernel-azure-extraUpgrade kernel-kvmsmallUpgrade kernel-macrosUpgrade dtb-amazonUpgrade dtb-hisiliconUpgrade kernel-64kb-livepatch-develUpgrade kernel-symsUpgrade dlm-kmp-64kbUpgrade dtb-exynosUpgrade kselftests-kmp-rtUpgrade dtb-armUpgrade dlm-kmp-rtUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-azure-develUpgrade gfs2-kmp-azureUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-rtUpgrade kernel-rt-optionalUpgrade dtb-renesasUpgrade kernel-rt-develUpgrade kernel-docsUpgrade kernel-default-base-rebuildUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-rtUpgrade ocfs2-kmp-defaultUpgrade dtb-qcomUpgrade kernel-obs-buildUpgrade dtb-nvidiaUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-azureUpgrade kernel-default-baseUpgrade kernel-source-rtUpgrade kernel-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-rt_debug-develUpgrade kernel-default-livepatch-develUpgrade kernel-debug-vdsoUpgrade dtb-socionextUpgrade kernel-defaultUpgrade dtb-sprdUpgrade gfs2-kmp-defaultUpgrade dtb-cavium | Jun 24, 2024 | May 19, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-kvmUpgrade linux-image-virtualUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-lowlatency-64kUpgrade linux-image-genericUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-38-genericUpgrade linux-image-nvidia-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-lowlatencyUpgrade linux-image-oracle-64kUpgrade linux-image-azure-fdeUpgrade linux-image-ibmUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-azureUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-intelUpgrade linux-image-raspiUpgrade linux-image-gkeUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-awsUpgrade linux-image-generic-64k-hwe-24.04 | Jul 12, 2024 | May 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub