CVE-2025-40316: drm/mediatek: Fix device use-after-free on unbind

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-08 · updated 2026-10-14

Description

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix device use-after-free on unbind A recent change fixed device reference leaks when looking up drm platform device driver data during bind() but failed to remove a partial fix which had been added by commit 80805b62ea5b ("drm/mediatek: Fix kobject put for component sub-drivers"). This results in a reference imbalance on component bind() failures and on unbind() which could lead to a user-after-free. Make sure to only drop the references after retrieving the driver data by effectively reverting the previous partial fix. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.

Affected products

Linux kernel: from 6.6.105 before 6.6.117; from 6.12.45 before 6.12.58; from 6.16.5 before 6.17; 6.17 — fixed in 6.12.58, 6.17, 6.18, 6.6.117

How to fix

Upgrade to a fixed version: Linux kernel 6.12.58, 6.17, 6.18, 6.6.117. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-40316 or the next vulnerability affects your stack