CVE-2025-39882

What it actually does

Incorrect reference counting on device tree nodes during for_each_child_of_node() iteration in the Mediatek DRM driver allows a use-after-free when a bogus of_node_put() decrement is applied at each loop step instead of only on early exit.

Why it matters to the business

Risk of kernel crashes, denial of service, or local privilege escalation on Linux systems using Mediatek graphics hardware; low but non-zero exploit likelihood requires prompt patching to protect containerized and virtualized workloads.

How an attack unfolds

A local attacker loads or triggers the Mediatek DRM driver code paths that iterate child OF nodes, causing premature node freeing due to the erroneous reference decrement, then reuses the dangling pointer for memory corruption leading to privilege escalation.

How to fix it

Upgrade the Linux kernel to version 6.6.107 or apply commit b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d; for affected Debian pacemaker packages upgrade to 1.1.6-1 or newer.

How to confirm the fix worked

Confirm the running kernel reports version 6.6.107 or later and verify the fix commit appears in the DRM Mediatek source tree; test driver probe paths with OF node iteration under memory debugging tools.

Typical attack path

1. Gain local user access on an affected Linux system
2. Trigger Mediatek DRM driver probe or initialization involving child OF nodes
3. Force the faulty reference decrement loop to produce a use-after-free
4. Leverage the freed node for memory corruption and privilege escalation

How to detect it

Inspect kernel logs for oops or panic messages referencing drm/mediatek and OF node reference counts; correlate with process activity that initializes the Mediatek display driver shortly before crashes.

What your security team should do

• Apply kernel updates to 6.6.107 or fixed commit immediately on all systems with Mediatek DRM
• Review and restrict local access on hosts exposing graphics drivers
• Enable kernel hardening features such as KASAN or hardened usercopy during validation