CVE-2025-23160 – A resource leak vulnerability in the MediaTek v... (How to Fix)

Q: What is the severity of CVE-2025-23160?

CVE-2025-23160 has a CVSS score of 5.5 (MEDIUM). A resource leak vulnerability in the MediaTek video codec driver for Linux kernel allows attackers to cause memory exhaustion on affected systems. This affects Linux systems running on MediaTek hardware with system companion processor (SCP) support. The vulnerability occurs during firmware initialization when allocation fails but resources aren't properly cleaned up.

📋 TL;DR

A resource leak vulnerability in the MediaTek video codec driver for Linux kernel allows attackers to cause memory exhaustion on affected systems. This affects Linux systems running on MediaTek hardware with system companion processor (SCP) support. The vulnerability occurs during firmware initialization when allocation fails but resources aren't properly cleaned up.

💻 Affected Systems

Products:

Linux kernel with MediaTek video codec driver (media: mediatek: vcodec)

Versions: Linux kernel versions containing the vulnerable code prior to fixes in stable commits

Operating Systems: Linux distributions running on MediaTek hardware with SCP

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with MediaTek hardware that uses system companion processor (SCP) for video codec operations

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Memory exhaustion leading to system instability, kernel panic, or denial of service on affected MediaTek devices

🟠

Likely Case

Gradual memory consumption over time causing performance degradation or application crashes

🟢

If Mitigated

Minimal impact with proper memory monitoring and resource limits in place

🌐 Internet-Facing: LOW - Requires local access or ability to trigger specific driver initialization

🏢 Internal Only: MEDIUM - Could be exploited by malicious local users or through other vulnerabilities to cause denial of service

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to trigger firmware initialization failures in the MediaTek video codec driver, typically requiring local access or another vulnerability chain

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel stable commits: 4936cd5817af35d23e4d283f48fa59a18ef481e4, 69dd5bbdd79c65445bb17c3c53510783bc1d756c, 9f009fa823c54ca0857c81f7525ea5a5d32de29c, ac94e1db4b2053059779472eb58a64d504964240, d6cb086aa52bd51378a4c9e2b25d2def97770205

Vendor Advisory: https://git.kernel.org/stable/c/4936cd5817af35d23e4d283f48fa59a18ef481e4

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For embedded MediaTek devices, obtain updated firmware from device manufacturer. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable MediaTek video codec driver

linux

Prevent loading of the vulnerable driver module

echo 'blacklist mtk-vcodec' > /etc/modprobe.d/blacklist-mtk-vcodec.conf
rmmod mtk_vcodec_dec mtk_vcodec_enc

Limit memory usage

linux

Set memory limits to contain potential resource exhaustion

ulimit -v 2097152
sysctl -w vm.overcommit_memory=2

🧯 If You Can't Patch

Restrict local user access to systems with vulnerable MediaTek hardware
Implement strict memory monitoring and alerting for abnormal consumption patterns

🔍 How to Verify

Check if Vulnerable:

Check if MediaTek video codec driver is loaded: lsmod | grep mtk_vcodec AND check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits: grep -r 'mtk_scp' /usr/src/linux-headers-$(uname -r) OR check if driver loads without errors in dmesg

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages related to mtk_vcodec
Memory allocation failures in kernel logs
SCP firmware initialization errors

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("mtk_vcodec" OR "SCP" OR "resource leak")

📊 Metadata

CVE ID: CVE-2025-23160

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

EPSS Score: 0.04% exploit probability (11.1th percentile)

Published: May 1, 2025

Last Updated: November 6, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-23160, you might also want to check these: