In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock… (CVE-2024-35920)
CVE-2024-35920 is a medium severity vulnerability in the Linux kernel's MediaTek video codec driver. It involves a missing lock protecting the decoder context list, which can lead to a NULL pointer dereference in the vpu_dec_ipi_handler function. This flaw can cause a kernel panic and denial of service on affected systems. The issue arises from unexpected behavior in the SCP IP block leading to deletion of the context list without proper synchronization.
AI Analysis
Technical Summary
This vulnerability in the Linux kernel MediaTek vcodec driver (CVE-2024-35920) is caused by the absence of a lock protecting the decoder context list (ctx_list). Without this lock, the vpu_dec_ipi_handler function may access a NULL pointer if the ctx_list has been deleted due to unexpected behavior on the SCP IP block. This results in a fatal kernel exception (kernel panic) and stops system operation. The issue was resolved by adding a lock to protect the ctx_list, preventing access to a NULL pointer. The vulnerability is classified under CWE-476 (NULL Pointer Dereference) and has a CVSS 3.1 base score of 5.5 (medium severity), with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact.
Potential Impact
Exploitation of this vulnerability can cause a denial of service via a kernel panic due to a NULL pointer dereference in the MediaTek video codec driver. There is no impact on confidentiality or integrity, but system availability is severely affected as the kernel stops functioning.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel by adding a lock to protect the decoder context list. Users should monitor official Linux kernel releases and apply updates that include this fix once available.
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock… (CVE-2024-35920)
Description
CVE-2024-35920 is a medium severity vulnerability in the Linux kernel's MediaTek video codec driver. It involves a missing lock protecting the decoder context list, which can lead to a NULL pointer dereference in the vpu_dec_ipi_handler function. This flaw can cause a kernel panic and denial of service on affected systems. The issue arises from unexpected behavior in the SCP IP block leading to deletion of the context list without proper synchronization.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in the Linux kernel MediaTek vcodec driver (CVE-2024-35920) is caused by the absence of a lock protecting the decoder context list (ctx_list). Without this lock, the vpu_dec_ipi_handler function may access a NULL pointer if the ctx_list has been deleted due to unexpected behavior on the SCP IP block. This results in a fatal kernel exception (kernel panic) and stops system operation. The issue was resolved by adding a lock to protect the ctx_list, preventing access to a NULL pointer. The vulnerability is classified under CWE-476 (NULL Pointer Dereference) and has a CVSS 3.1 base score of 5.5 (medium severity), with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact.
Potential Impact
Exploitation of this vulnerability can cause a denial of service via a kernel panic due to a NULL pointer dereference in the MediaTek video codec driver. There is no impact on confidentiality or integrity, but system availability is severely affected as the kernel stops functioning.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel by adding a lock to protect the decoder context list. Users should monitor official Linux kernel releases and apply updates that include this fix once available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-78cr-5pf2-63v5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2024-35920"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a71feebbf8831d539ff12d1
Added to database: 08/04/2026, 15:02:03 UTC
Last enriched: 08/04/2026, 15:18:06 UTC
Last updated: 08/04/2026, 15:21:09 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.