Linux Kernel Vulnerability in MediaTek VCodec Context List Protection

CVE-2025-71140

What is CVE-2025-71140?

A vulnerability has been identified in the Linux kernel's MediaTek VCodec module, where the context lists for encoder and decoder operations are not adequately protected. The initial implementation utilized a mutex to secure these lists, which proved inadequate due to changes from the SCP IP block leading to potential NULL pointer dereferences in the IPI handler. The issue manifests particularly on the MT8173 chipset when the VPU IPI handler is invoked from a hard IRQ context, triggering scheduler warnings. The problem was observed in ChromeOS kernels and is also reproducible on the mainline version using Fluster in conjunction with FFmpeg v4l2m2m decoders. The update replaces the mutex with a spinlock, ensuring faster operations on the context list while enhancing stability.

References