Skip to main content

Linux Kernel EUVDEUVD-2026-25455

| CVE-2026-31562 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-04-24 Linux GHSA-6f2j-r97j-f7v5
Denial Of Service Linux Null Pointer Dereference Mediatek
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Obtain local access with module-loading rights
  2. Delivery
    Load or auto-load mediatek_drm module
  3. Exploit
    mipi_dsi_host_register triggers panel probe
  4. Install
    mtk_dsi_bind callback fires before drvdata initialized
  5. C2
    dev_get_drvdata returns NULL
  6. Execute
    NULL dereference at drm_mode_object_add
  7. Impact
    Kernel panic, system unavailable

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires: (1) ARM64 hardware with a MediaTek SoC that includes a MIPI DSI display controller (e.g., devices using MT8195, MT8186, or similar); (2) a MIPI DSI panel driver (such as panel_simple) attached and probing the DSI bus; (3) local access with sufficient privileges to load the mediatek_drm kernel module (PR:L per CVSS, typically requiring root or a user in the video/render group on embedded Linux); (4) a kernel version between commit e4732b590a77 and the respective fix commit. Systems without MediaTek display hardware are entirely unaffected. The crash occurs only during the module initialization (probe) phase - it does not persist as a runtime exploitable condition. No network exposure, no user interaction, and no special configuration beyond the presence of MediaTek DRM hardware are required.
Impact

The CVSS 3.1 score of 5.5 Medium (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is consistent with the technical facts: local access with low privileges is required to trigger the initialization path, and the sole impact is a kernel panic rendering the system unavailable. EPSS at 0.02% (4th percentile) signals negligible near-term exploitation probability, and there is no CISA KEV listing and no public exploit code. The combination of hardware-specific targeting (MediaTek DRM), local access requirement, and crash-only impact substantially limits real-world risk beyond embedded and IoT device contexts. There is no conflict between CVSS signals and the description - both indicate a locally-triggered, hardware-specific availability fault. This is a genuine maintenance/stability fix rather than a security priority for most environments; it is a priority only for vendors and system integrators shipping MediaTek display hardware on Linux.
Exploit ScenarioDerived

A local user with module-loading privileges on a MediaTek ARM64 device (such as a smart display or IoT device running a vulnerable kernel) loads or triggers auto-loading of the mediatek_drm module at boot. During driver probe, the NULL dereference fires inside the DRM encoder initialization path, producing a kernel oops/panic that crashes or locks the system. No proof-of-concept is needed beyond simply booting the driver on affected hardware; the crash is deterministic on vulnerable kernel versions with MediaTek DSI panels attached.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

NULL pointer dereference in the Linux kernel's MediaTek DSI DRM driver causes a kernel panic during module initialization on ARM64 systems with MediaTek display hardware. The crash occurs because mipi_dsi_host_register triggers the mtk_dsi_bind callback before the mtk_dsi struct is stored in driver data, dereferencing a NULL pointer inside drm_mode_object_add and acquiring mode_config.idr_mutex before panicking - blocking all subsequent DRM operations on the system. No public exploit exists and EPSS stands at 0.02%, consistent with a hardware-specific local denial-of-service with no confidentiality or integrity impact.

RemediationAI

Upgrade to Linux 6.18.21, 6.19.11, or 7.0, which contain the one-line fix reordering dev_set_drvdata to precede the mipi_dsi_host_register call. The upstream stable commits are available at https://git.kernel.org/stable/c/df03f5ac1eae7c5a2c01846e3e64dfc2870eec6b (6.18.x), https://git.kernel.org/stable/c/9a709b7e36324dfc1e6728eb81405470b7ae84e5 (6.19.x), and https://git.kernel.org/stable/c/4cfdfeb6ac06079f92fccd977fa742d6c5b8dd3a (7.0). If an immediate kernel upgrade is not feasible, blacklisting the mediatek_drm module via /etc/modprobe.d/ (e.g., blacklist mediatek_drm) will prevent the crash; the trade-off is complete loss of display functionality on affected hardware. Red Hat and SUSE users should monitor vendor errata channels for backported stable kernel packages. No generic network or perimeter controls are applicable given the local, module-load-time trigger.

Affected VersionsENISA

Linux e4732b590a77318dff134612b013d66d2448ab20 <df03f5ac1eae7c5a2c01846e3e64dfc2870eec6b
Linux patch: 6.18.21
Linux 6.9
Linux patch: 0
Linux e4732b590a77318dff134612b013d66d2448ab20 <9a709b7e36324dfc1e6728eb81405470b7ae84e5
Linux patch: 6.19.11
Linux patch: 7.0
Linux e4732b590a77318dff134612b013d66d2448ab20 <4cfdfeb6ac06079f92fccd977fa742d6c5b8dd3a

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected code is in drivers/gpu/drm/mediatek/mtk_dsi.c, specifically the mtk_dsi_probe function in the MediaTek DRM subsystem. The root cause (CWE-476, NULL Pointer Dereference) is an initialization ordering bug: mipi_dsi_host_register is called before dev_set_drvdata stores the mtk_dsi struct, but the MIPI DSI subsystem immediately probes attached panel drivers upon host registration. This triggers the chain mipi_dsi_host_register → mipi_dsi_device_register_full → device_add → panel_simple_dsi_probe → mipi_dsi_attach → mtk_dsi_host_attach → component_add → mtk_drm_bind → mtk_dsi_bind, where mtk_dsi_bind calls dev_get_drvdata expecting the struct but receives NULL. The dereference occurs at drm_mode_object_add+0x58 when initializing the DRM encoder, address offset 0x40 into the NULL struct. The CPE cpe:2.3:a:linux:linux identifies the Linux kernel broadly; the practical scope is ARM64 systems running MediaTek SoCs with MIPI DSI panels.

Know when Mediatek gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local module load with low privileges (AV:L, PR:L) triggers deterministic crash; impact is availability only (A:H), with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Apr 27, 2026 - 20:37 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:30 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
CVE Published
Apr 24, 2026 - 14:35 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register

The call to mipi_dsi_host_register triggers a callback to mtk_dsi_bind, which uses dev_get_drvdata to retrieve the mtk_dsi struct, so this structure needs to be stored inside the driver data before invoking it.

As drvdata is currently uninitialized it leads to a crash when registering the DSI DRM encoder right after acquiring the mode_config.idr_mutex, blocking all subsequent DRM operations.

Fixes the following crash during mediatek-drm probe (tested on Xiaomi Smart Clock x04g):

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000040 [...] Modules linked in: mediatek_drm(+) drm_display_helper cec drm_client_lib drm_dma_helper drm_kms_helper panel_simple [...] Call trace: drm_mode_object_add+0x58/0x98 (P) __drm_encoder_init+0x48/0x140 drm_encoder_init+0x6c/0xa0 drm_simple_encoder_init+0x20/0x34 [drm_kms_helper] mtk_dsi_bind+0x34/0x13c [mediatek_drm] component_bind_all+0x120/0x280 mtk_drm_bind+0x284/0x67c [mediatek_drm] try_to_bring_up_aggregate_device+0x23c/0x320 __component_add+0xa4/0x198 component_add+0x14/0x20 mtk_dsi_host_attach+0x78/0x100 [mediatek_drm] mipi_dsi_attach+0x2c/0x50 panel_simple_dsi_probe+0x4c/0x9c [panel_simple] mipi_dsi_drv_probe+0x1c/0x28 really_probe+0xc0/0x3dc __driver_probe_device+0x80/0x160 driver_probe_device+0x40/0x120 __device_attach_driver+0xbc/0x17c bus_for_each_drv+0x88/0xf0 __device_attach+0x9c/0x1cc device_initial_probe+0x54/0x60 bus_probe_device+0x34/0xa0 device_add+0x5b0/0x800 mipi_dsi_device_register_full+0xdc/0x16c mipi_dsi_host_register+0xc4/0x17c mtk_dsi_probe+0x10c/0x260 [mediatek_drm] platform_probe+0x5c/0xa4 really_probe+0xc0/0x3dc __driver_probe_device+0x80/0x160 driver_probe_device+0x40/0x120 __driver_attach+0xc8/0x1f8 bus_for_each_dev+0x7c/0xe0 driver_attach+0x24/0x30 bus_add_driver+0x11c/0x240 driver_register+0x68/0x130 __platform_register_drivers+0x64/0x160 mtk_drm_init+0x24/0x1000 [mediatek_drm] do_one_initcall+0x60/0x1d0 do_init_module+0x54/0x240 load_module+0x1838/0x1dc0 init_module_from_file+0xd8/0xf0 __arm64_sys_finit_module+0x1b4/0x428 invoke_syscall.constprop.0+0x48/0xc8 do_el0_svc+0x3c/0xb8 el0_svc+0x34/0xe8 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: 52800022 941004ab 2a0003f3 37f80040 (29005a80)

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Prevalence
Medium
MediaTek SoCs common in ARM embedded, IoT, and consumer display devices
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Mediatek

View all
CVE-2024-20017 CRITICAL POC
9.8 Mar 04

In wlan service, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS
CVE-2017-3216 CRITICAL POC
9.8 Jun 20

WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypa
CVE-2019-15027 CRITICAL POC
9.8 Aug 14

The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows atta
CVE-2016-6492 HIGH POC
7.8 Jan 12

The MT6573FDVT_SetRegHW function in camera_fdvt.c in the MediaTek driver for Linux allows local users to gain privileges
CVE-2023-32874 CRITICAL
9.8 Jan 02

In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. Rated critical severity (CVSS
CVE-2025-20654 CRITICAL
9.8 Apr 07

In wlan service, there is a possible out of bounds write due to an incorrect bounds check. Rated critical severity (CVSS
CVE-2025-20646 CRITICAL
9.8 Mar 03

In wlan AP FW, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9
CVE-2025-20672 CRITICAL
9.8 Jun 02

Heap OOB write in Android Bluetooth driver via incorrect bounds check.
CVE-2025-20674 CRITICAL
9.8 Jun 02

Remote privilege escalation in Android WLAN AP driver via packet injection.
CVE-2025-20684 CRITICAL
9.8 Jul 08

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
CVE-2025-20683 CRITICAL
9.8 Jul 08

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
CVE-2025-20682 CRITICAL
9.8 Jul 08

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-31562 ADVISORY https://vuldb.com/vuln/359376 REF https://git.kernel.org/stable/c/4cfdfeb6ac06079f92fccd977fa742d6c5b8dd3a REF https://git.kernel.org/stable/c/57b4864ca02f76d7debe8ce14c912335aef16055 REF https://git.kernel.org/stable/c/9a709b7e36324dfc1e6728eb81405470b7ae84e5 REF https://git.kernel.org/stable/c/df03f5ac1eae7c5a2c01846e3e64dfc2870eec6b

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy