CVE-2025-71140: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71140 is a NULL pointer dereference vulnerability in the Linux kernel's MediaTek video codec (vcodec) driver, specifically in the media: mediatek: vcodec subsystem. The flaw arises from the use of a mutex to protect encoder/decoder context lists in a code path that is invoked from hard IRQ context on the MT8173 SoC, causing a scheduler warning and potential NULL pointer dereference in the IPI handler. It was published on January 14, 2026, and affects the Linux kernel on systems using the MediaTek MT8173 VPU. No official CVSS score has been assigned by NVD at this time; Feedly estimates the severity as Medium (Feedly, NVD).

The root cause is an improper locking primitive selection: a mutex was used to protect the encoder/decoder context lists in the MediaTek vcodec driver, but the VPU IPI handler on MT8173 is called from hard IRQ context, where sleeping locks (mutexes) cannot be held. This mismatch causes a kernel scheduler warning (BUG: sleeping function called from invalid context) and can result in a NULL pointer dereference if the context pointer becomes invalid during concurrent access from the SCP IP block. The issue is reproducible on mainline kernels using Fluster with FFmpeg v4l2m2m decoders, even when the capture format is not fully supported, because the vulnerable code paths are still triggered. The fix replaces the mutex with a spinlock, which is safe to use in hard IRQ context and appropriate given the brevity of the protected operations (NVD, Feedly).

Exploitation of this vulnerability can cause a kernel NULL pointer dereference, leading to a system crash (denial of service) on affected Linux systems running on MediaTek MT8173 hardware, such as certain Chromebooks. The impact is primarily an availability concern — a local user or process triggering the vulnerable video codec path could destabilize or crash the kernel. There is no evidence of confidentiality or integrity impact beyond the crash itself (NVD).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-71140. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Triggering the bug requires local access to a system with a MediaTek MT8173 VPU and the ability to initiate video codec operations (e.g., via FFmpeg v4l2m2m) (Feedly, NVD).

The fix has been committed to the Linux stable kernel tree across multiple stable branches, replacing the mutex with a spinlock in the MediaTek vcodec context list protection. Users should apply the relevant upstream patches: commit 2c1ea62, commit 3e85893, commit a584422, and commit b92c196. Administrators running Linux on MediaTek MT8173-based devices (e.g., certain Chromebooks) should update to a kernel version that includes these patches. As a temporary workaround, avoiding use of the MediaTek vcodec driver (e.g., disabling FFmpeg v4l2m2m decoding) can reduce exposure (NVD).