Medium severity · published May 1, 2025
CVE-2025-23160
media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
On Mediatek devices with a system companion processor (SCP) the mtk_scp
structure has to be removed explicitly to avoid a resource leak.
Free the structure in case the allocation of the firmware structure fails
during the firmware initialization.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
6.1.130 before 6.1.153; 6.6.36 before 6.6.88; 6.9.7 before 6.12.24; 6.13 before 6.13.12; 6.14 before 6.14.3 · source: NVD
LI
Linux · Linux
ac79a923365ae1e524398087cf16313cdbd7a144 before beaefe8dbb261f36376bb533a89ed69ab38e6747; 19ef02106c990bf4235365a08b9d8d2fee37272a before 2540a81d5532829150b2e7cca977313b524066a9; eeb62bb4ca22db17f7dfe8fb8472e0442df3d92f before 69dd5bbdd79c65445bb17c3c53510783bc1d756c; f066882293b5ad359e44c4ed24ab1811ffb0b354 before fd7bb97ede487b9f075707b7408a9073e0d474b1; 53dbe08504442dc7ba4865c09b3bbf5fe849681b before 9f009fa823c54ca0857c81f7525ea5a5d32de29c; 53dbe08504442dc7ba4865c09b3bbf5fe849681b before d6cb086aa52bd51378a4c9e2b25d2def97770205; +7 more · source: vendor
DL
Debian Linux · Debian
11.0 · source: NVD
SC
SIMATIC CN 4100 · Siemens
before V5.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-23160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-23160
git.kernel.org
https://git.kernel.org/stable/c/2540a81d5532829150b2e7cca977313b524066a9
Patch
https://git.kernel.org/stable/c/4936cd5817af35d23e4d283f48fa59a18ef481e4
Patch
https://git.kernel.org/stable/c/69dd5bbdd79c65445bb17c3c53510783bc1d756c
Patch
https://git.kernel.org/stable/c/9f009fa823c54ca0857c81f7525ea5a5d32de29c
Patch
https://git.kernel.org/stable/c/ac94e1db4b2053059779472eb58a64d504964240
git.kernel.org
https://git.kernel.org/stable/c/beaefe8dbb261f36376bb533a89ed69ab38e6747
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability