CVE-2026-46058 Details
Description
In the Linux kernel, the following vulnerability has been resolved: media: amphion: Fix race between m2m job_abort and device_run Fix kernel panic caused by race condition where v4l2_m2m_ctx_release() frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run with the same context. Race sequence: v4l2_m2m_try_run(): v4l2_m2m_ctx_release(): lock/unlock v4l2_m2m_cancel_job() job_abort() v4l2_m2m_job_finish() kfree(m2m_ctx) <- frees ctx device_run() <- use-after-free crash at 0x538 Crash trace: Unable to handle kernel read from unreadable memory at virtual address 0000000000000538 v4l2_m2m_try_run+0x78/0x138 v4l2_m2m_device_run_work+0x14/0x20 The amphion vpu driver does not rely on the m2m framework's device_run callback to perform encode/decode operations. Fix the race by preventing m2m framework job scheduling entirely: - Add job_ready callback returning 0 (no jobs ready for m2m framework) - Remove job_abort callback to avoid the race condition
A race condition vulnerability has been identified in the Linux kernel's Amphion media driver, specifically within the V4L2 memory-to-memory (m2m) framework. This vulnerability causes a kernel panic due to a use-after-free error. The issue arises when the function v4l2_m2m_ctx_release() frees the m2m context while v4l2_m2m_try_run() is preparing to execute the device_run() function using the same context. The resulting race condition leads to a crash, as the system attempts to read from a memory address that has already been freed, causing an invalid memory access error.
The vulnerability has been addressed by modifying the Amphion VPU driver's integration with the V4L2 m2m framework. The driver now includes a job_ready callback that indicates no jobs are ready for the m2m framework, effectively preventing the scheduling of jobs that could trigger the race condition. This update is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/42dc622776f3ce1a6c31b13bdc686f7295e3b323 | kernel.org | Patch |
| https://git.kernel.org/stable/c/516467052fdfc6a13eadc70d43420ae57436bf3c | kernel.org | Patch |
| https://git.kernel.org/stable/c/6be2cb75bc1300080cfc8051579f22efae9401f7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8cd35ceadcfc8c5da2eb7f7ce24525ce9d4ee62e | kernel.org | Patch |
| https://git.kernel.org/stable/c/da4f46c5cf1d26e6b09418ad453e152f2e75a02c | kernel.org | Patch |
| https://git.kernel.org/stable/c/fdc150dac1adb9a98be9d6956cff0348838b024a | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.18, < 6.1.175 >= 6.2, < 6.6.140 >= 6.7, < 6.12.86 >= 6.13, < 6.18.27 >= 6.19, < 7.0.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| Jun 1, 2026 | CVE Modified | kernel.org |
| May 30, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |