CVE-2026-98781

What it actually does

Reference count leak on a platform device obtained via of_find_device_by_node in mtk_drm_bind when the device is not the MMSYS master; the reference is never released because mtk_drm_unbind only drops it for the master path.

Why it matters to the business

On Linux systems using Mediatek display hardware, repeated driver bind/unbind operations in non-master configurations can slowly exhaust device references, risking kernel memory pressure or instability; low prevalence and no known exploitation keep overall operational risk minimal five days after disclosure.

How an attack unfolds

No public exploits or threat actor campaigns are associated with this issue. Exploitation would require local access to repeatedly trigger the non-master bind path in the Mediatek DRM driver, accumulating unreleased references until resource limits are hit.

How to fix it

Apply the upstream fix that adds the missing put_device call before returning from the non-master path in mtk_drm_bind; rebuild and deploy the updated kernel on affected Mediatek platforms.

How to confirm the fix worked

Review the patched mtk_drm_bind function to confirm of_find_device_by_node is paired with a put_device in every return path; enable kernel reference-count debugging or kmemleak and exercise bind/unbind cycles to verify no further leaks.

Typical attack path

1. Obtain local access on a system with Mediatek DRM hardware configured as a non-master device
2. Repeatedly load and unload the driver or trigger mtk_drm_bind to exercise the early-return leak path
3. Accumulate unreleased device references until kernel resource exhaustion or instability occurs

How to detect it

Examine kernel logs for repeated DRM or platform-device reference warnings during driver load; use dynamic memory-leak detectors such as kmemleak or reference-count tracers while exercising mtk_drm_bind on non-master devices.

What your security team should do

• Prioritize kernel updates on any Mediatek DRM systems within normal patch cycles given the five-day disclosure window and stable low EPSS
• Add the driver source path to code-review and static-analysis pipelines to catch similar reference-handling omissions
• Monitor upstream stable kernel releases for backports of this fix