CVE-2024-40973

What it actually does

The vulnerability is a missing null check after devm_kzalloc in the mtk-vcodec SCP driver, allowing a subsequent dereference of a null pointer and resulting in memory corruption or kernel crash.

Why it matters to the business

Systems running affected Linux kernels may experience unexpected crashes or denial-of-service conditions in media/video workloads, leading to operational downtime and potential data loss until the system is restarted; prevalence in the Linux kernel ecosystem increases exposure for servers and embedded devices.

How an attack unfolds

An attacker with the ability to exercise the mtk-vcodec code path triggers an allocation failure so that devm_kzalloc returns NULL; the driver then dereferences the pointer without checking, producing a kernel fault that may be turned into memory corruption for privilege escalation.

How to fix it

Apply the upstream fix present in commit eeb62bb4ca22db17f7dfe8fb8472e0442df3d92f or any later stable kernel that includes this change; rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Inspect the driver source for an explicit NULL check immediately after the devm_kzalloc call for the SCP structure, or confirm the presence of commit eeb62bb4ca22db17f7dfe8fb8472e0442df3d92f in the running kernel tree.

Typical attack path

1. Obtain local execution on a system using the mtk-vcodec driver
2. Force the allocation in the SCP initialization path to fail
3. Trigger the subsequent dereference of the unchecked pointer
4. Exploit the resulting memory corruption for code execution or denial of service

How to detect it

Examine kernel logs for oops or panic messages referencing mtk-vcodec, SCP, or null pointer dereferences in media drivers; correlate with process activity that exercises video codec initialization.

What your security team should do

• Prioritize patching all systems that include the mtk-vcodec driver
• Review kernel update policies to ensure timely incorporation of stable fixes
• Test the patched kernel in a staging environment before broad deployment