Resource Leak Vulnerability in Linux Kernel on Mediatek Devices
Summary
CVE-2025-23160: In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization On Mediatek devices with a system companion processor (SCP)... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is widely used in various devices, including Mediatek devices that incorporate a system companion processor (SCP). This kernel manages system resources and ensures efficient operation. However, vulnerabilities can arise, impacting system stability and security, particularly in resource management.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified related to the MediaTek vcodec where the mtk_scp structure was not being properly released during firmware initialization. This oversight can lead to a resource leak, potentially causing system instability and performance degradation on devices utilizing the SCP. The issue arises when the firmware structure allocation fails, and the corresponding mtk_scp structure is not freed, resulting in wasted system resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux package as described above.
Conclusion
The CVE-2025-23160 vulnerability in the Linux kernel poses a significant risk to Mediatek devices due to a resource leak during firmware initialization. Users are encouraged to update their systems to the latest patched version to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-23160 is a vulnerability in the Linux kernel affecting Mediatek devices, specifically related to a resource leak during firmware initialization.
This vulnerability can lead to resource leaks, which may cause system instability and performance issues on devices using the affected Linux kernel.
If your device runs on the affected versions of the Linux kernel in Debian 12 or 13, it may be at risk. It is advisable to check for updates and apply them.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If updating is not possible, monitor your system closely for any signs of instability and consider isolating the affected application until a fix can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
