Cloudanix VulnDB

CVE-2026-98783

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A simple coding oversight in the Linux kernel's graphics driver for certain chips can make computers crash without warning during normal startup.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing IS_ERR check after platform_device_register_data() allows ERR_PTR to be stored in ddp_comp[].dev and passed to component_match_add() and mtk_ddp_comp_init(), resulting in invalid pointer dereference and kernel crash in the mediatek DRM driver.

Why it matters to the business

Affected Linux systems may experience unexpected kernel panics during display initialization on MediaTek hardware, causing downtime and reduced reliability only five days after public disclosure with low but stable exploit probability.

How an attack unfolds

An attacker triggers mediatek DRM driver initialization under conditions where platform_device_register_data fails, causing the unchecked error pointer to propagate through component registration paths and induce a kernel panic; no named threat actors or ransomware use reported.

How to fix it

Apply the upstream fix that adds an explicit IS_ERR check and error-path jump after the platform_device_register_data call; update to a patched kernel version containing the resolution for drm/mediatek.

How to confirm the fix worked

Inspect the mediatek ddp_comp initialization code for the presence of the IS_ERR guard on the ovl_adaptor registration result; reproduce registration failure in a test environment and confirm no crash occurs.

Typical attack path

  1. Trigger loading or probe of the mediatek DRM driver
  2. Induce failure in platform_device_register_data for ovl_adaptor
  3. Allow invalid ERR_PTR to be stored and passed to component_match_add and mtk_ddp_comp_init
  4. Trigger dereference leading to kernel oops or panic

How to detect it

Search kernel logs and oops traces for mediatek DRM registration failures, ddp_comp references, and platform_device errors around ovl_adaptor; correlate with component_match_add or mtk_ddp_comp_init call sites.

What your security team should do

  • Expedite kernel updates on all MediaTek DRM systems given the five-day publication window
  • Include the mediatek DRM paths in crash-dump and kernel-log monitoring
  • Validate the fix in staging before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device platform_device_register_data() can fail and return an ERR_PTR, but the return value is used without checking, leading to an invalid pointer being stored in ddp_comp[].dev and passed to component_match_add() and mtk_ddp_comp_init(), which could result in a kernel crash. Add an IS_ERR() check to jump to the error handling path on failure.

Affected packages

Ecosystem Package Introduced Fixed