CVE-2026-64358 Details
Description
In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtk_jpeg_release function cancels any pending or running work present in the driver workqueue using cancel_work_sync function. Currently, only the multicore based variants use this workqueue and they have the jpeg_worker platform data field initialized with a workqueue callback function. For the others, this field value remain NULL by default. The cancel_work_sync function is unconditionally called in mtk_jpeg_release function, even for the variants that do not use the workqueue. This call generates a WARN_ON print in __flush_work because the workqueue callback function presence check fails in __flush_work function (used by cancel_work_sync). So, to avoid these warnings, call cancel_work_sync only if a workqueue callback is defined in platform data.
A vulnerability exists in the Linux kernel's media subsystem, specifically within the MTK JPEG driver, related to improper workqueue management during the release process. The issue arises because the 'mtk_jpeg_release' function unconditionally cancels work in the driver’s workqueue, using 'cancel_work_sync'. This behavior is only appropriate for multicore variants that utilize the workqueue, as they have the 'jpeg_worker' platform data field initialized with a workqueue callback. In contrast, other variants leave this field NULL by default. The unconditional cancellation triggers a warning in the workqueue flushing process, indicating a mismatch in expected workqueue usage. This vulnerability has been addressed by modifying the release function to check for the presence of a workqueue callback before attempting to cancel any work, thereby preventing unnecessary warnings and ensuring proper workqueue management.
The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version of the stable Linux kernel where this issue has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0fed0fc34ce734b4b8c2f6a467d38bddcb21dda9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/4c4b4af4a9f278da096f0dbdb6b59594701d29bf | kernel.org | Patch |
| https://git.kernel.org/stable/c/973408ceab14555a8548b97c8cc7b54208c3f251 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ac0774961a6ea174a71d4ffa39966edafbf7662d | kernel.org | Patch |
| https://git.kernel.org/stable/c/b1845a227fda37b2fe5327df3ca0015d7e290235 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.6.140, < 6.6.145 >= 6.12.86, < 6.12.96 >= 6.18.27, < 6.18.39 >= 7.0.4, < 7.1.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | Initial Analysis | [email protected] |
| Aug 17, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |