PT-2026-64579 · Linux · Linux

CVE-2026-64358 · Published 2026-07-25 · Updated 2026-07-25

NVD

In the Linux kernel, the following vulnerability has been resolved:

media: mtk-jpeg: cancel workqueue on release for supported platforms only

Since a recent fix the mtk jpeg release function cancels any pending or running work present in the driver workqueue using cancel work sync function. Currently, only the multicore based variants use this workqueue and they have the jpeg worker platform data field initialized with a workqueue callback function. For the others, this field value remain NULL by default. The cancel work sync function is unconditionally called in mtk jpeg release function, even for the variants that do not use the workqueue. This call generates a WARN ON print in flush work because the workqueue callback function presence check fails in flush work function (used by cancel work sync).

So, to avoid these warnings, call cancel work sync only if a workqueue callback is defined in platform data.

Related Identifiers

CVE-2026-64358

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-64358 · Security Note
• https://git.kernel.org/stable/c/0fed0fc34ce734b4b8c2f6a467d38bddcb21dda9 · Note
• https://git.kernel.org/stable/c/4c4b4af4a9f278da096f0dbdb6b59594701d29bf · Note
• https://git.kernel.org/stable/c/ac0774961a6ea174a71d4ffa39966edafbf7662d · Note
• https://git.kernel.org/stable/c/973408ceab14555a8548b97c8cc7b54208c3f251 · Note
• https://git.kernel.org/stable/c/b1845a227fda37b2fe5327df3ca0015d7e290235 · Note