CVE-2025-23160CWE-401

CVE-2025-23160

Medium · published May 1, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
11.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization

On Mediatek devices with a system companion processor (SCP) the mtk_scp

structure has to be removed explicitly to avoid a resource leak.

Free the structure in case the allocation of the firmware structure fails

during the firmware initialization.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00214 · 11.2th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2025-05-01T17:15Z
Affected products (6)
ProductVersionsFixed in
linux/linux_kernel≥ 6.1.130, < 6.1.1536.1.153
linux/linux_kernel≥ 6.6.36, < 6.6.886.6.88
linux/linux_kernel≥ 6.9.7, < 6.12.246.12.24
linux/linux_kernel≥ 6.13, < 6.13.126.13.12
linux/linux_kernel≥ 6.14, < 6.14.36.14.3
debian/debian_linuxall versions—
References (10)
EPSS history
Timeline
  • 01 MAY 12:55Z
    media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
    cvelistv5