CVE-2026-64358

media: mtk-jpeg: cancel workqueue on release for supported platforms only

MEDIUM
5.5
CVSS Score
Published: July 25, 2026 at 08:50 AM UTC
Updated: September 4, 2026 at 04:16 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtk_jpeg_release function cancels any pending or running work present in the driver workqueue using cancel_work_sync function. Currently, only the multicore based variants use this workqueue and they have the jpeg_worker platform data field initialized with a workqueue callback function. For the others, this field value remain NULL by default. The cancel_work_sync function is unconditionally called in mtk_jpeg_release function, even for the variants that do not use the workqueue. This call generates a WARN_ON print in __flush_work because the workqueue callback function presence check fails in __flush_work function (used by cancel_work_sync). So, to avoid these warnings, call cancel_work_sync only if a workqueue callback is defined in platform data.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v ≥ 7.0.46.12.86 ≤ v < 6.12.966.18.27 ≤ v < 6.18.396.6.140 ≤ v < 6.6.1457.0.4 ≤ v < 7.17.0.4 ≤ v < 7.1.47.1 ≤ v < 7.1.47.1 ≤ v < 7.22209fdae5c2f615930c9af1379c1cfca199ec5d826506a30e0e26d612f82a7bf0e395626968a44e634c519feef3e4fcff1078dc8bdb25fbbbd10303f498b27a1542021d90269d58347501d4c3ccd84e6.12.866.18.276.6.1407.0.47.1e78c39f720679fcf3a2eacd82725ec3ea2648301
Vendor states this is fixed in 0fed0fc34ce734b4b8c2f6a467d38bddcb21dda9 (fixed)
Vendor states this is fixed in 4c4b4af4a9f278da096f0dbdb6b59594701d29bf (fixed)
Vendor states this is fixed in 973408ceab14555a8548b97c8cc7b54208c3f251 (fixed)
Vendor states this is fixed in ac0774961a6ea174a71d4ffa39966edafbf7662d (fixed)
Vendor states this is fixed in b1845a227fda37b2fe5327df3ca0015d7e290235 (fixed)
Vendor states this is fixed in 6.12.96 (unaffected)
Vendor states this is fixed in 6.18.39 (unaffected)
Vendor states this is fixed in 6.6.145 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)
Vendor states this is fixed in 7.1.4 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card