{"id":"CVE-2026-98781","kind":"vulnerability","aliases":["CVE-2026-98781"],"related":[],"title":"Linux kernel: MediaTek DRM bind leaks a device reference on non-master path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Fix pdev reference leak in mtk_drm_bind()\n\nWhen the device is not the mmsys master, mtk_drm_bind() returns early\nafter taking a reference on the disp-mutex device via\nof_find_device_by_node(), without ever dropping it: mtk_drm_unbind()\nonly puts mutex_dev for the master. Drop the reference before returning\nfrom the non-master path.","summary":"In the Linux kernel's MediaTek DRM driver, mtk_drm_bind() takes a reference to the disp-mutex device and returns early on non-master devices without releasing it. The fix drops that reference before the early return.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","linux-kernel","mediatek-soc"],"not_affected_if":["no-mediatek-drm"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing mtk_drm_bind() (drm/mediatek: Fix pdev reference leak); the sources do not name a fixed version.","status":"open","published_at":"2026-10-18T16:17:32+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:22+00:00","updated_at":"2026-10-25T05:15:22+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:15:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing mtk_drm_bind() (drm/mediatek: Fix pdev reference leak); the sources do not name a fixed version.","reach":"local","title":"Linux kernel: MediaTek DRM bind leaks a device reference on non-master path","impact":"low","summary":"In the Linux kernel's MediaTek DRM driver, mtk_drm_bind() takes a reference to the disp-mutex device and returns early on non-master devices without releasing it. The fix drops that reference before the early return.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","mediatek-soc","embedded"],"confidence":0.6,"needs_auth":"unknown","worst_case":"a leaked device reference, causing resource leakage in the kernel","analyst_note":"","how_to_check":"- unknown","needs_analyst":false,"not_affected_if":["no-mediatek-drm"],"who_is_affected":"Systems running a Linux kernel with the MediaTek DRM driver on MediaTek SoC hardware with multiple display devices, where a non-master mmsys device binds. Standard x86 servers and most cloud VMs do not load this driver, so they can skip it. The sources do not describe the exact trigger conditions beyond this code path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000583,"input_tokens":3371,"output_tokens":491,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98781':17A,20A 'bind':5A,39B,87C,98C 'cve':15A,18A 'dev':127C 'devic':8A,48B,56B,90C,110C,114C 'disp':46B,108C 'disp-mutex':45B,107C 'driver':36B 'drm':4A,35B,38B,86C,97C,122C 'drm/mediatek':79C 'drop':62B,119C,131C 'earli':51B,67B,100C 'embed':21B 'ever':118C 'find':113C 'fix':61B,80C 'follow':74C 'infrastructur':22B 'kernel':2A,25B,32B,72C 'leak':6A,83C 'linux':1A,24B,31B,71C 'linux-kernel':23B 'master':13A,55B,95C,130C,140C 'mediatek':3A,27B,34B 'mediatek-soc':26B 'mmsys':94C 'mtk':37B,85C,96C,121C 'mutex':47B,109C,126C 'node':116C 'non':12A,54B,139C 'non-mast':11A,53B,138C 'path':14A,141C 'pdev':81C 'put':125C 'refer':9A,42B,64B,82C,104C,133C 'releas':58B 'resolv':78C 'return':50B,68B,99C,135C 'soc':28B 'take':40B,102C 'unbind':123C 'via':111C 'vulner':75C 'without':57B,117C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the MediaTek DRM driver on MediaTek SoC hardware with multiple display devices, where a non-master mmsys device binds. Standard x86 servers and most cloud VMs do not load this driver, so they can skip it. The sources do not describe the exact trigger conditions beyond this code path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98781","severity":null,"published_at":"2026-10-18T16:17:32+00:00","modified_at":"2026-10-21T13:21:46+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}