CVE-2023-54147: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-54147 is a vulnerability in the Linux kernel's media platform driver (media: platform: mtk-mdp3) affecting the MediaTek MDP3 (Media Data Path) subsystem. The flaw involves a missing return value check for ida_alloc and a missing resource free on error paths in mdp_m2m_open, which can lead to a NULL pointer dereference and memory leak. It affects Linux kernel versions from the introduction of commit 61890ccaefaff89f5babd2c8412fd222c3f5fe38 up to the respective stable backport fixes. The vulnerability was published on December 24, 2025, with an EPSS score of approximately 0.018% (very low), and no CVSS base score has been assigned (Feedly, EUVD).

The root cause is a missing check on the return value of ida_alloc() in the mdp_m2m_open function within the media/platform/mtk-mdp3 driver (CWE-476: NULL Pointer Dereference; CWE-401: Missing Release of Memory after Effective Lifetime). If ida_alloc fails and returns a negative error code, the code proceeds without validating the result, potentially dereferencing a NULL or invalid pointer. Additionally, if mdp_m2m_open fails at a later stage, the already-allocated ctx->id is not freed, resulting in a memory leak. The fix adds a return value check for ida_alloc and ensures ctx->id is freed on failure paths (Feedly).

Exploitation of this vulnerability could cause a kernel NULL pointer dereference, leading to a system crash (denial of service) on affected Linux systems using the MediaTek MDP3 media platform driver. The memory leak aspect could gradually degrade system stability over time. The impact is generally limited to local availability, as the affected code path is within a kernel media driver typically accessible only to privileged or device-owning processes (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-54147. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection has been noted by Nessus plugin 280068 (Tenable, Feedly).

The Linux kernel stable tree has released patches addressing this vulnerability across multiple stable branches. Fixed versions include kernel 6.1.28, 6.2.15, 6.3.2, and 6.4 (mainline). Users should update to a patched kernel version corresponding to their distribution's stable branch. The relevant upstream commits are 51fc1880e474, 4c173a65a2b1, 22b72cad501f, and d00f59225078 (Feedly).