PT-2026-43878 · Linux · Linux Kernel

Published 2026-05-27 · Updated 2026-06-04 · CVE-2026-46011

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11-1.1

Description A use-after-free issue exists in the mtk jpeg release() function. The function frees the context structure ctx without cancelling pending or running work in ctx->jpeg work. This creates a race condition where the mtk jpegenc worker() callback may access the context memory after it has been freed. The work is typically queued via queue work() during JPEG encode or decode operations through mtk jpeg device run(). If the device is closed while work is pending, the handler accesses freed memory.

Recommendations Update to version 7.0.11-1.1.

Fix

Related Identifiers

CVE-2026-46011

OPENSUSE-SU-2026:10954-1

Affected Products

Linux Kernel

References · 289

• https://cve.org/CVERecord?id=CVE-2026-46011 · Security Note
• https://ubuntu.com/security/CVE-2026-46011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46011 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-46011 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10954-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-46011 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-46011 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-46011 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-45839 · Note
• https://suse.com/security/cve/CVE-2026-46227 · Note
• https://suse.com/security/cve/CVE-2026-46066 · Note
• https://suse.com/security/cve/CVE-2026-46136 · Note
• https://suse.com/security/cve/CVE-2026-46111 · Note
• https://suse.com/security/cve/CVE-2026-46006 · Note
• https://git.kernel.org/linus/34c519feef3e4fcff1078dc8bdb25fbbbd10303f · Note