CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
3186 vulnerabilities reference this CWE, most recent first.
GHSA-J6MR-2J2F-GXH9
Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2024-02-16 21:31The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.
{
"affected": [],
"aliases": [
"CVE-2014-4699"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-07-09T11:07:00Z",
"severity": "MODERATE"
},
"details": "The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.",
"id": "GHSA-j6mr-2j2f-gxh9",
"modified": "2024-02-16T21:31:30Z",
"published": "2022-05-13T01:23:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4699"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1115927"
},
{
"type": "WEB",
"url": "https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.47"
},
{
"type": "WEB",
"url": "https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.11"
},
{
"type": "WEB",
"url": "https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.97"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a"
},
{
"type": "WEB",
"url": "http://linux.oracle.com/errata/ELSA-2014-0924.html"
},
{
"type": "WEB",
"url": "http://linux.oracle.com/errata/ELSA-2014-3047.html"
},
{
"type": "WEB",
"url": "http://linux.oracle.com/errata/ELSA-2014-3048.html"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/07/05/4"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/07/08/16"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/07/08/5"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/127573/Linux-Kernel-ptrace-sysret-Local-Privilege-Escalation.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59633"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59639"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59654"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60220"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60380"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60393"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-2972"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/34134"
},
{
"type": "WEB",
"url": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/07/04/4"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/108754"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2266-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2267-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2268-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2269-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2270-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2271-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2272-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2273-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2274-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J6R2-Q88X-5M39
Vulnerability from github – Published: 2024-12-12 03:33 – Updated: 2024-12-12 03:33Windows Remote Desktop Services Remote Code Execution Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-49132"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-12T02:04:40Z",
"severity": "HIGH"
},
"details": "Windows Remote Desktop Services Remote Code Execution Vulnerability",
"id": "GHSA-j6r2-q88x-5m39",
"modified": "2024-12-12T03:33:05Z",
"published": "2024-12-12T03:33:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49132"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49132"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J6X4-C8GH-G296
Vulnerability from github – Published: 2023-03-14 18:30 – Updated: 2023-03-14 18:30Windows Graphics Component Elevation of Privilege Vulnerability
{
"affected": [],
"aliases": [
"CVE-2023-24861"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-14T17:15:00Z",
"severity": "HIGH"
},
"details": "Windows Graphics Component Elevation of Privilege Vulnerability",
"id": "GHSA-j6x4-c8gh-g296",
"modified": "2023-03-14T18:30:20Z",
"published": "2023-03-14T18:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24861"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24861"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J6XP-8WG9-2GF2
Vulnerability from github – Published: 2022-05-17 02:37 – Updated: 2022-05-17 02:37Race condition in the get implementation in the ServiceWorkerManager class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted web site.
{
"affected": [],
"aliases": [
"CVE-2016-2812"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-04-30T17:59:00Z",
"severity": "HIGH"
},
"details": "Race condition in the get implementation in the ServiceWorkerManager class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted web site.",
"id": "GHSA-j6xp-8wg9-2gf2",
"modified": "2022-05-17T02:37:36Z",
"published": "2022-05-17T02:37:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2812"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1261776"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201701-15"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2016-05/msg00038.html"
},
{
"type": "WEB",
"url": "http://www.mozilla.org/security/announce/2016/mfsa2016-42.html"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1035692"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2936-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2936-2"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2936-3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J6XX-FW69-3F9G
Vulnerability from github – Published: 2022-05-17 05:04 – Updated: 2022-05-17 05:04Passcode Lock in Apple iOS before 7 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging a race condition involving phone calls and ejection of a SIM card.
{
"affected": [],
"aliases": [
"CVE-2013-5147"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-09-19T10:28:00Z",
"severity": "LOW"
},
"details": "Passcode Lock in Apple iOS before 7 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging a race condition involving phone calls and ejection of a SIM card.",
"id": "GHSA-j6xx-fw69-3f9g",
"modified": "2022-05-17T05:04:01Z",
"published": "2022-05-17T05:04:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5147"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/54886"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT5934"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J737-8H5G-42G9
Vulnerability from github – Published: 2024-02-21 15:30 – Updated: 2024-06-03 18:55In the Linux kernel, the following vulnerability has been resolved:
tls: fix race between async notify and socket close
The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data.
Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization.
Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires.
{
"affected": [],
"aliases": [
"CVE-2024-26583"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-21T15:15:09Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix race between async notify and socket close\n\nThe submitting thread (one which called recvmsg/sendmsg)\nmay exit as soon as the async crypto handler calls complete()\nso any code past that point risks touching already freed data.\n\nTry to avoid the locking and extra flags altogether.\nHave the main thread hold an extra reference, this way\nwe can depend solely on the atomic ref counter for\nsynchronization.\n\nDon\u0027t futz with reiniting the completion, either, we are now\ntightly controlling when completion fires.",
"id": "GHSA-j737-8h5g-42g9",
"modified": "2024-06-03T18:55:49Z",
"published": "2024-02-21T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26583"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OX4EWCYDZRTOEMC2C6OF7ZACAP23SUB5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J7CP-5J3G-7Q5W
Vulnerability from github – Published: 2026-04-22 15:31 – Updated: 2026-07-14 15:31In the Linux kernel, the following vulnerability has been resolved:
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows:
CPU0 CPU1
deferred_split_scan() zap_nonpresent_ptes() lock folio split_folio() unmap_folio() change ptes to migration entries __split_folio_to_order() softleaf_to_folio() set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry)) smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio)) prep_compound_page() for tail pages
In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags.
This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio() because of the race between folio split and zap_nonpresent_ptes() leading to a folio incorrectly undergoing modification without a folio lock being held.
This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"), which in merged in v6.19-rc1.
To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page().
[tujinjiang@huawei.com: update function name and comments]
{
"affected": [],
"aliases": [
"CVE-2026-31466"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-22T14:16:42Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix folio isn\u0027t locked in softleaf_to_folio()\n\nOn arm64 server, we found folio that get from migration entry isn\u0027t locked\nin softleaf_to_folio(). This issue triggers when mTHP splitting and\nzap_nonpresent_ptes() races, and the root cause is lack of memory barrier\nin softleaf_to_folio(). The race is as follows:\n\n\tCPU0 CPU1\n\ndeferred_split_scan() zap_nonpresent_ptes()\n lock folio\n split_folio()\n unmap_folio()\n change ptes to migration entries\n __split_folio_to_order() softleaf_to_folio()\n set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry))\n smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio))\n prep_compound_page() for tail pages\n\nIn __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages\nare visible before the tail page becomes non-compound. smp_wmb() should\nbe paired with smp_rmb() in softleaf_to_folio(), which is missed. As a\nresult, if zap_nonpresent_ptes() accesses migration entry that stores tail\npfn, softleaf_to_folio() may see the updated compound_head of tail page\nbefore page-\u003eflags.\n\nThis issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()\nbecause of the race between folio split and zap_nonpresent_ptes()\nleading to a folio incorrectly undergoing modification without a folio\nlock being held.\n\nThis is a BUG_ON() before commit 93976a20345b (\"mm: eliminate further\nswapops predicates\"), which in merged in v6.19-rc1.\n\nTo fix it, add missing smp_rmb() if the softleaf entry is migration entry\nin softleaf_to_folio() and softleaf_to_page().\n\n[tujinjiang@huawei.com: update function name and comments]",
"id": "GHSA-j7cp-5j3g-7q5w",
"modified": "2026-07-14T15:31:52Z",
"published": "2026-04-22T15:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31466"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/426ee10711586617da869c8bb798214965337617"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4c5e7f0fcd592801c9cc18f29f80fbee84eb8669"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/722cfaf6b31d31123439e67b5deac6b1261a3dea"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7ad1997b9bc8032603df8f091761114479285769"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7ddcf4a245c1c5a91fdd9698757e3d95179ffe41"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8bfb8414e9f2ce6f5f2f0e3d0da52f2d132128e7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b8c49ad888892ad7b77062b9c102b799a3e9b4f8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f1acf5887c2bbaf998dc3fe32c72b7a8b84a3ddd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J7JM-6Q5X-FFR4
Vulnerability from github – Published: 2024-08-12 15:30 – Updated: 2024-08-12 18:30A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler executes in the context of the sshd(8)'s privileged code, which is not sandboxed and runs with full root privileges.
This issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh. The faulty code in this case is from the integration of blacklistd in OpenSSH in FreeBSD.
As a result of calling functions that are not async-signal-safe in the privileged sshd(8) context, a race condition exists that a determined attacker may be able to exploit to allow an unauthenticated remote code execution as root.
{
"affected": [],
"aliases": [
"CVE-2024-7589"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-364"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-12T13:38:44Z",
"severity": "HIGH"
},
"details": "A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler executes in the context of the sshd(8)\u0027s privileged code, which is not sandboxed and runs with full root privileges.\n\nThis issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh. The faulty code in this case is from the integration of blacklistd in OpenSSH in FreeBSD.\n\nAs a result of calling functions that are not async-signal-safe in the privileged sshd(8) context, a race condition exists that a determined attacker may be able to exploit to allow an unauthenticated remote code execution as root.",
"id": "GHSA-j7jm-6q5x-ffr4",
"modified": "2024-08-12T18:30:47Z",
"published": "2024-08-12T15:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7589"
},
{
"type": "WEB",
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:08.openssh.asc"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2006-5051"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6387"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J7PJ-JR9C-8HG7
Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-06-01 18:31In the Linux kernel, the following vulnerability has been resolved:
media: amphion: Fix race between m2m job_abort and device_run
Fix kernel panic caused by race condition where v4l2_m2m_ctx_release() frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run with the same context.
Race sequence: v4l2_m2m_try_run(): v4l2_m2m_ctx_release(): lock/unlock v4l2_m2m_cancel_job() job_abort() v4l2_m2m_job_finish() kfree(m2m_ctx) <- frees ctx device_run() <- use-after-free crash at 0x538
Crash trace: Unable to handle kernel read from unreadable memory at virtual address 0000000000000538 v4l2_m2m_try_run+0x78/0x138 v4l2_m2m_device_run_work+0x14/0x20
The amphion vpu driver does not rely on the m2m framework's device_run callback to perform encode/decode operations.
Fix the race by preventing m2m framework job scheduling entirely: - Add job_ready callback returning 0 (no jobs ready for m2m framework) - Remove job_abort callback to avoid the race condition
{
"affected": [],
"aliases": [
"CVE-2026-46058"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-27T14:17:25Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: amphion: Fix race between m2m job_abort and device_run\n\nFix kernel panic caused by race condition where v4l2_m2m_ctx_release()\nfrees m2m_ctx while v4l2_m2m_try_run() is about to call device_run\nwith the same context.\n\nRace sequence:\n v4l2_m2m_try_run(): v4l2_m2m_ctx_release():\n lock/unlock v4l2_m2m_cancel_job()\n job_abort()\n v4l2_m2m_job_finish()\n kfree(m2m_ctx) \u003c- frees ctx\n device_run() \u003c- use-after-free crash at 0x538\n\nCrash trace:\n Unable to handle kernel read from unreadable memory at virtual address\n 0000000000000538\n v4l2_m2m_try_run+0x78/0x138\n v4l2_m2m_device_run_work+0x14/0x20\n\nThe amphion vpu driver does not rely on the m2m framework\u0027s device_run\ncallback to perform encode/decode operations.\n\nFix the race by preventing m2m framework job scheduling entirely:\n- Add job_ready callback returning 0 (no jobs ready for m2m framework)\n- Remove job_abort callback to avoid the race condition",
"id": "GHSA-j7pj-jr9c-8hg7",
"modified": "2026-06-01T18:31:35Z",
"published": "2026-05-27T15:33:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46058"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/42dc622776f3ce1a6c31b13bdc686f7295e3b323"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/516467052fdfc6a13eadc70d43420ae57436bf3c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6be2cb75bc1300080cfc8051579f22efae9401f7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8cd35ceadcfc8c5da2eb7f7ce24525ce9d4ee62e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/da4f46c5cf1d26e6b09418ad453e152f2e75a02c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fdc150dac1adb9a98be9d6956cff0348838b024a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J7Q7-6R65-3H7H
Vulnerability from github – Published: 2026-01-14 03:30 – Updated: 2026-01-14 03:30Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.
{
"affected": [],
"aliases": [
"CVE-2025-68962"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-14T03:15:50Z",
"severity": "MODERATE"
},
"details": "Multi-thread race condition vulnerability in the camera framework module.\nImpact: Successful exploitation of this vulnerability may affect availability.",
"id": "GHSA-j7q7-6r65-3h7h",
"modified": "2026-01-14T03:30:26Z",
"published": "2026-01-14T03:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68962"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2026/1"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.