What’s Vulnerable › Vulnerabilities

CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-12 · updated 2026-08-23
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: media: mtk-vcodec: potential null pointer deference in SCP The return value of devm_kzalloc() needs to be checked to avoid NULL pointer deference. This is similar to CVE-2022-3113.

Affected products

• Linux kernel: before 6.6.36; from 6.7 before 6.9.7 — fixed in 6.6.36, 6.9.7

How to fix

Upgrade to a fixed version: Linux kernel 6.6.36, 6.9.7. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/19ef02106c990bf4235365a08b9d8d2fee37272a
• https://git.kernel.org/stable/c/3a693c7e243b932faee5c1fb728efa73f0abc39b
• https://git.kernel.org/stable/c/53dbe08504442dc7ba4865c09b3bbf5fe849681b
• https://git.kernel.org/stable/c/ac79a923365ae1e524398087cf16313cdbd7a144
• https://git.kernel.org/stable/c/eeb62bb4ca22db17f7dfe8fb8472e0442df3d92f
• https://git.kernel.org/stable/c/f066882293b5ad359e44c4ed24ab1811ffb0b354
• https://git.kernel.org/stable/c/3a693c7e243b932faee5c1fb728efa73f0abc39b
• https://git.kernel.org/stable/c/53dbe08504442dc7ba4865c09b3bbf5fe849681b
• https://git.kernel.org/stable/c/f066882293b5ad359e44c4ed24ab1811ffb0b354
• https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Get alerted when CVE-2024-40973 or the next vulnerability affects your stack