CVE-2025-23160: 
Linux Kernel vulnerability analysis and mitigation

A resource leak vulnerability (CVE-2025-23160) was discovered in the Linux kernel's MediaTek video codec driver, specifically affecting the media subsystem. The vulnerability was disclosed on May 1, 2025, and impacts MediaTek devices with a system companion processor (SCP) (NVD, Wiz).

The vulnerability stems from a failure to properly manage the mtkscp structure in the MediaTek video codec driver during firmware initialization. Specifically, when the allocation of the firmware structure fails, the mtkscp structure remains allocated, leading to a resource leak. The issue has been assigned a moderate severity rating with a CVSSv3 score of 5.5 (Wiz).

The resource leak can result in system resource exhaustion over time on affected MediaTek devices. This could potentially impact system stability and performance, particularly in systems that frequently initialize the video codec firmware (Wiz).

The vulnerability has been fixed in various Linux distributions. Debian has marked it as fixed in version 5.10.223-1 for bullseye and 6.12.25-1 for sid. Red Hat has acknowledged the vulnerability and is addressing it across multiple versions of Red Hat Enterprise Linux (Wiz).