PT-2026-2901 · Mediatek+5 · Mediatek Vdec+5
Published
2025-01-01
·
Updated
2026-05-11
·
CVE-2025-71140
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A flaw exists in the Linux kernel’s media subsystem, specifically within the MediaTek vcodec component. A previous implementation used a mutex to protect encoder and decoder context lists from modifications originating from the SCP IP block, which could lead to a NULL pointer dereference in the IPI handler. The issue occurs because the VPU IPI handler is called from a hard IRQ context, triggering a scheduler warning. This was initially reported in ChromeOS kernels and is reproducible on mainline kernels using Fluster with FFmpeg v4l2m2m decoders. The problem is triggered even when the capture format is unsupported. The lock protects the context list and operations on it are fast, so switching to a spinlock resolves the issue.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Chrome Os
Ffmpeg
Linuxmint
Linux Kernel
Mediatek Vdec
Ubuntu