PT-2026-43925 · Linux · Linux

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-46058

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

media: amphion: Fix race between m2m job abort and device run

Fix kernel panic caused by race condition where v4l2 m2m ctx release() frees m2m ctx while v4l2 m2m try run() is about to call device run with the same context.

Race sequence: v4l2 m2m try run(): v4l2 m2m ctx release(): lock/unlock v4l2 m2m cancel job() job abort() v4l2 m2m job finish() kfree(m2m ctx) <- frees ctx device run() <- use-after-free crash at 0x538

Crash trace: Unable to handle kernel read from unreadable memory at virtual address 0000000000000538 v4l2 m2m try run+0x78/0x138 v4l2 m2m device run work+0x14/0x20

The amphion vpu driver does not rely on the m2m framework's device run callback to perform encode/decode operations.

Fix the race by preventing m2m framework job scheduling entirely:

• Add job ready callback returning 0 (no jobs ready for m2m framework)
• Remove job abort callback to avoid the race condition

Fix

Related Identifiers

CVE-2026-46058

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46058 · Security Note
• https://git.kernel.org/stable/c/fdc150dac1adb9a98be9d6956cff0348838b024a · Note
• https://git.kernel.org/stable/c/6be2cb75bc1300080cfc8051579f22efae9401f7 · Note
• https://git.kernel.org/stable/c/da4f46c5cf1d26e6b09418ad453e152f2e75a02c · Note
• https://git.kernel.org/stable/c/8cd35ceadcfc8c5da2eb7f7ce24525ce9d4ee62e · Note
• https://git.kernel.org/stable/c/42dc622776f3ce1a6c31b13bdc686f7295e3b323 · Note