CVE-2026-31584 (GCVE-0-2026-31584)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:42 – Updated: 2026-08-05 12:23
VLAI
Title
media: mediatek: vcodec: fix use-after-free in encoder release path
Summary
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: fix use-after-free in encoder release path The fops_vcodec_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx->encode_work. This creates a race window where the workqueue handler (mtk_venc_worker) may still be accessing the context memory after it has been freed. Race condition: CPU 0 (release path) CPU 1 (workqueue) --------------------- ------------------ fops_vcodec_release() v4l2_m2m_ctx_release() v4l2_m2m_cancel_job() // waits for m2m job "done" mtk_venc_worker() v4l2_m2m_job_finish() // m2m job "done" // BUT worker still running! // post-job_finish access: other ctx dereferences // UAF if ctx already freed // returns (job "done") kfree(ctx) // ctx freed Root cause: The v4l2_m2m_ctx_release() only waits for the m2m job lifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle. After v4l2_m2m_job_finish() is called, the m2m framework considers the job complete and v4l2_m2m_ctx_release() returns, but the worker function continues executing and may still access ctx. The work is queued during encode operations via: queue_work(ctx->dev->encode_workqueue, &ctx->encode_work) The worker function accesses ctx->m2m_ctx, ctx->dev, and other ctx fields even after calling v4l2_m2m_job_finish(). This vulnerability was confirmed with KASAN by running an instrumented test module that widens the post-job_finish race window. KASAN detected: BUG: KASAN: slab-use-after-free in mtk_venc_worker+0x159/0x180 Read of size 4 at addr ffff88800326e000 by task kworker/u8:0/12 Workqueue: mtk_vcodec_enc_wq mtk_venc_worker Allocated by task 47: __kasan_kmalloc+0x7f/0x90 fops_vcodec_open+0x85/0x1a0 Freed by task 47: __kasan_slab_free+0x43/0x70 kfree+0xee/0x3a0 fops_vcodec_release+0xb7/0x190 Fix this by calling cancel_work_sync(&ctx->encode_work) before kfree(ctx). This ensures the workqueue handler is both cancelled (if pending) and synchronized (waits for any running handler to complete) before the context is freed. Placement rationale: The fix is placed after v4l2_ctrl_handler_free() and before list_del_init(&ctx->list). At this point, all m2m operations are done (v4l2_m2m_ctx_release() has returned), and we need to ensure the workqueue is synchronized before removing ctx from the list and freeing it. Note: The open error path does NOT need cancel_work_sync() because INIT_WORK() only initializes the work structure - it does not schedule it. Work is only scheduled later during device_run() operations.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0934d37596151edce115c6d0843a9ad7d5e5d232 , < 9a9bdaf9dc42ccca50e53f82165292f74a365c11 (git)
Affected: 0934d37596151edce115c6d0843a9ad7d5e5d232 , < a8a55913552aed45108525d1851c65e1db0cc25b (git)
Affected: 0934d37596151edce115c6d0843a9ad7d5e5d232 , < f99353cd0e9f58bf17889049137b8d65fb44ebf1 (git)
Affected: 0934d37596151edce115c6d0843a9ad7d5e5d232 , < 93d9a58961a9e09306857e999b3ee76aa4be67f0 (git)
Affected: 0934d37596151edce115c6d0843a9ad7d5e5d232 , < f1692337c6fa26e04f89b22a4d84bf5b7ada50d1 (git)
Affected: 0934d37596151edce115c6d0843a9ad7d5e5d232 , < 76e35091ffc722ba39b303e48bc5d08abb59dd56 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.136 , ≤ 6.6.* (semver)
Unaffected: 6.12.83 , ≤ 6.12.* (semver)
Unaffected: 6.18.24 , ≤ 6.18.* (semver)
Unaffected: 6.19.14 , ≤ 6.19.* (semver)
Unaffected: 7.0.1 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a9bdaf9dc42ccca50e53f82165292f74a365c11",
              "status": "affected",
              "version": "0934d37596151edce115c6d0843a9ad7d5e5d232",
              "versionType": "git"
            },
            {
              "lessThan": "a8a55913552aed45108525d1851c65e1db0cc25b",
              "status": "affected",
              "version": "0934d37596151edce115c6d0843a9ad7d5e5d232",
              "versionType": "git"
            },
            {
              "lessThan": "f99353cd0e9f58bf17889049137b8d65fb44ebf1",
              "status": "affected",
              "version": "0934d37596151edce115c6d0843a9ad7d5e5d232",
              "versionType": "git"
            },
            {
              "lessThan": "93d9a58961a9e09306857e999b3ee76aa4be67f0",
              "status": "affected",
              "version": "0934d37596151edce115c6d0843a9ad7d5e5d232",
              "versionType": "git"
            },
            {
              "lessThan": "f1692337c6fa26e04f89b22a4d84bf5b7ada50d1",
              "status": "affected",
              "version": "0934d37596151edce115c6d0843a9ad7d5e5d232",
              "versionType": "git"
            },
            {
              "lessThan": "76e35091ffc722ba39b303e48bc5d08abb59dd56",
              "status": "affected",
              "version": "0934d37596151edce115c6d0843a9ad7d5e5d232",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: fix use-after-free in encoder release path\n\nThe fops_vcodec_release() function frees the context structure (ctx)\nwithout first cancelling any pending or running work in ctx-\u003eencode_work.\nThis creates a race window where the workqueue handler (mtk_venc_worker)\nmay still be accessing the context memory after it has been freed.\n\nRace condition:\n\n    CPU 0 (release path)               CPU 1 (workqueue)\n    ---------------------               ------------------\n    fops_vcodec_release()\n      v4l2_m2m_ctx_release()\n        v4l2_m2m_cancel_job()\n        // waits for m2m job \"done\"\n                                        mtk_venc_worker()\n                                          v4l2_m2m_job_finish()\n                                          // m2m job \"done\"\n                                          // BUT worker still running!\n                                          // post-job_finish access:\n                                        other ctx dereferences\n                                          // UAF if ctx already freed\n        // returns (job \"done\")\n      kfree(ctx)  // ctx freed\n\nRoot cause: The v4l2_m2m_ctx_release() only waits for the m2m job\nlifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle.\nAfter v4l2_m2m_job_finish() is called, the m2m framework considers\nthe job complete and v4l2_m2m_ctx_release() returns, but the worker\nfunction continues executing and may still access ctx.\n\nThe work is queued during encode operations via:\n  queue_work(ctx-\u003edev-\u003eencode_workqueue, \u0026ctx-\u003eencode_work)\nThe worker function accesses ctx-\u003em2m_ctx, ctx-\u003edev, and other ctx\nfields even after calling v4l2_m2m_job_finish().\n\nThis vulnerability was confirmed with KASAN by running an instrumented\ntest module that widens the post-job_finish race window. KASAN detected:\n\n  BUG: KASAN: slab-use-after-free in mtk_venc_worker+0x159/0x180\n  Read of size 4 at addr ffff88800326e000 by task kworker/u8:0/12\n\n  Workqueue: mtk_vcodec_enc_wq mtk_venc_worker\n\n  Allocated by task 47:\n    __kasan_kmalloc+0x7f/0x90\n    fops_vcodec_open+0x85/0x1a0\n\n  Freed by task 47:\n    __kasan_slab_free+0x43/0x70\n    kfree+0xee/0x3a0\n    fops_vcodec_release+0xb7/0x190\n\nFix this by calling cancel_work_sync(\u0026ctx-\u003eencode_work) before kfree(ctx).\nThis ensures the workqueue handler is both cancelled (if pending) and\nsynchronized (waits for any running handler to complete) before the\ncontext is freed.\n\nPlacement rationale: The fix is placed after v4l2_ctrl_handler_free()\nand before list_del_init(\u0026ctx-\u003elist). At this point, all m2m operations\nare done (v4l2_m2m_ctx_release() has returned), and we need to ensure\nthe workqueue is synchronized before removing ctx from the list and\nfreeing it.\n\nNote: The open error path does NOT need cancel_work_sync() because\nINIT_WORK() only initializes the work structure - it does not schedule\nit. Work is only scheduled later during device_run() operations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local V4L2 character device operations on the MediaTek mem2mem encoder, ending in `fops_vcodec_release()` after encode work is queued. It is not reachable directly by network packets or adjacent/physical input.\nAC:L - The attacker can queue encoder work with standard V4L2 ioctls and then close the same device while the workqueue handler is running. The race is attacker-driven and can be retried, so there are no external conditions that justify high complexity.\nPR:L - Triggering requires local access to the registered `/dev/video*` encoder node, but the driver and V4L2 core path contain no `capable()` or administrator-only checks. A basic local user with normal device-node access can reach the vulnerable ioctl/release path.\nUI:N - No victim action is required once the attacker can run code locally and access the video encoder device. The attacker controls the open, buffer queueing, streaming, and close operations.\nS:U - The vulnerability is in a kernel driver and impacts the same OS/kernel security authority. It does not cross a VM, hypervisor, IOMMU, or other separate security scope boundary.\nC:H - This is a slab use-after-free of the encoder context after `v4l2_m2m_job_finish()` lets release free the context while `mtk_venc_worker` can still dereference it. A kernel UAF is defensibly treated as enabling high confidentiality impact through heap reuse and memory disclosure primitives.\nI:H - The freed context contains pointers and state used by the worker, and UAF exploitation can be shaped with heap reuse to corrupt kernel control/data flow. Following the required overestimation rule for UAFs, integrity impact is high.\nA:H - KASAN confirmed a slab-use-after-free in `mtk_venc_worker`, and even non-exploited triggering can produce kernel oops/panic or destabilize the encoder workqueue path. Repeated local triggering can therefore cause high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:36.030Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a9bdaf9dc42ccca50e53f82165292f74a365c11"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8a55913552aed45108525d1851c65e1db0cc25b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f99353cd0e9f58bf17889049137b8d65fb44ebf1"
        },
        {
          "url": "https://git.kernel.org/stable/c/93d9a58961a9e09306857e999b3ee76aa4be67f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1692337c6fa26e04f89b22a4d84bf5b7ada50d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/76e35091ffc722ba39b303e48bc5d08abb59dd56"
        }
      ],
      "title": "media: mediatek: vcodec: fix use-after-free in encoder release path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31584",
    "datePublished": "2026-04-24T14:42:13.586Z",
    "dateReserved": "2026-03-09T15:48:24.120Z",
    "dateUpdated": "2026-08-05T12:23:36.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31584",
      "date": "2026-09-22",
      "epss": "0.00126",
      "percentile": "0.02592"
    },
    "microsoft_vex": {
      "current_release_date": "2026-04-30T01:53:23.000Z",
      "cve": "CVE-2026-31584",
      "id": "msrc_CVE-2026-31584",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "media: mediatek: vcodec: fix use-after-free in encoder release path",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31584.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9a9bdaf9dc42ccca50e53f82165292f74a365c11",
                    "status": "affected",
                    "version": "0934d37596151edce115c6d0843a9ad7d5e5d232",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a8a55913552aed45108525d1851c65e1db0cc25b",
                    "status": "affected",
                    "version": "0934d37596151edce115c6d0843a9ad7d5e5d232",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f99353cd0e9f58bf17889049137b8d65fb44ebf1",
                    "status": "affected",
                    "version": "0934d37596151edce115c6d0843a9ad7d5e5d232",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "93d9a58961a9e09306857e999b3ee76aa4be67f0",
                    "status": "affected",
                    "version": "0934d37596151edce115c6d0843a9ad7d5e5d232",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f1692337c6fa26e04f89b22a4d84bf5b7ada50d1",
                    "status": "affected",
                    "version": "0934d37596151edce115c6d0843a9ad7d5e5d232",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "76e35091ffc722ba39b303e48bc5d08abb59dd56",
                    "status": "affected",
                    "version": "0934d37596151edce115c6d0843a9ad7d5e5d232",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.136",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.83",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.24",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "14109CEF-714B-4029-A318-97AA58A01833",
                    "versionEndExcluding": "6.6.136",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A8BAD957-8E20-401C-A129-DFF3655CA0B7",
                    "versionEndExcluding": "6.12.83",
                    "versionStartIncluding": "6.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555",
                    "versionEndExcluding": "6.18.24",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB",
                    "versionEndExcluding": "6.19.14",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A",
                    "versionEndExcluding": "7.0.1",
                    "versionStartIncluding": "7.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: fix use-after-free in encoder release path\n\nThe fops_vcodec_release() function frees the context structure (ctx)\nwithout first cancelling any pending or running work in ctx-\u003eencode_work.\nThis creates a race window where the workqueue handler (mtk_venc_worker)\nmay still be accessing the context memory after it has been freed.\n\nRace condition:\n\n    CPU 0 (release path)               CPU 1 (workqueue)\n    ---------------------               ------------------\n    fops_vcodec_release()\n      v4l2_m2m_ctx_release()\n        v4l2_m2m_cancel_job()\n        // waits for m2m job \"done\"\n                                        mtk_venc_worker()\n                                          v4l2_m2m_job_finish()\n                                          // m2m job \"done\"\n                                          // BUT worker still running!\n                                          // post-job_finish access:\n                                        other ctx dereferences\n                                          // UAF if ctx already freed\n        // returns (job \"done\")\n      kfree(ctx)  // ctx freed\n\nRoot cause: The v4l2_m2m_ctx_release() only waits for the m2m job\nlifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle.\nAfter v4l2_m2m_job_finish() is called, the m2m framework considers\nthe job complete and v4l2_m2m_ctx_release() returns, but the worker\nfunction continues executing and may still access ctx.\n\nThe work is queued during encode operations via:\n  queue_work(ctx-\u003edev-\u003eencode_workqueue, \u0026ctx-\u003eencode_work)\nThe worker function accesses ctx-\u003em2m_ctx, ctx-\u003edev, and other ctx\nfields even after calling v4l2_m2m_job_finish().\n\nThis vulnerability was confirmed with KASAN by running an instrumented\ntest module that widens the post-job_finish race window. KASAN detected:\n\n  BUG: KASAN: slab-use-after-free in mtk_venc_worker+0x159/0x180\n  Read of size 4 at addr ffff88800326e000 by task kworker/u8:0/12\n\n  Workqueue: mtk_vcodec_enc_wq mtk_venc_worker\n\n  Allocated by task 47:\n    __kasan_kmalloc+0x7f/0x90\n    fops_vcodec_open+0x85/0x1a0\n\n  Freed by task 47:\n    __kasan_slab_free+0x43/0x70\n    kfree+0xee/0x3a0\n    fops_vcodec_release+0xb7/0x190\n\nFix this by calling cancel_work_sync(\u0026ctx-\u003eencode_work) before kfree(ctx).\nThis ensures the workqueue handler is both cancelled (if pending) and\nsynchronized (waits for any running handler to complete) before the\ncontext is freed.\n\nPlacement rationale: The fix is placed after v4l2_ctrl_handler_free()\nand before list_del_init(\u0026ctx-\u003elist). At this point, all m2m operations\nare done (v4l2_m2m_ctx_release() has returned), and we need to ensure\nthe workqueue is synchronized before removing ctx from the list and\nfreeing it.\n\nNote: The open error path does NOT need cancel_work_sync() because\nINIT_WORK() only initializes the work structure - it does not schedule\nit. Work is only scheduled later during device_run() operations."
          }
        ],
        "id": "CVE-2026-31584",
        "lastModified": "2026-06-17T10:34:01.643",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-04-24T15:16:33.117",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/76e35091ffc722ba39b303e48bc5d08abb59dd56"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/93d9a58961a9e09306857e999b3ee76aa4be67f0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9a9bdaf9dc42ccca50e53f82165292f74a365c11"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a8a55913552aed45108525d1851c65e1db0cc25b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f1692337c6fa26e04f89b22a4d84bf5b7ada50d1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f99353cd0e9f58bf17889049137b8d65fb44ebf1"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:26:38+00:00",
      "cve": "CVE-2026-31584",
      "id": "CVE-2026-31584",
      "initial_release_date": "2026-04-24T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: mediatek: vcodec: fix use-after-free in encoder release path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31584.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.