{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mtk-jpeg: fix use-after-free in release path due to uncancelled work\n\nThe mtk_jpeg_release() function frees the context structure (ctx) without\nfirst cancelling any pending or running work in ctx-\u003ejpeg_work. This\ncreates a race window where the workqueue callback may still be accessing\nthe context memory after it has been freed.\n\nRace condition:\n\n    CPU 0 (release)                    CPU 1 (workqueue)\n    ----------------                   ------------------\n    close()\n      mtk_jpeg_release()\n                                       mtk_jpegenc_worker()\n                                         ctx = work-\u003edata\n                                         // accessing ctx\n\n        kfree(ctx)  // freed!\n                                         access ctx  // UAF!\n\nThe work is queued via queue_work() during JPEG encode/decode operations\n(via mtk_jpeg_device_run). If the device is closed while work is pending\nor running, the work handler will access freed memory.\n\nFix this by calling cancel_work_sync() BEFORE acquiring the mutex. This\nordering is critical: if cancel_work_sync() is called after mutex_lock(),\nand the work handler also tries to acquire the same mutex, it would cause\na deadlock.\n\nNote: The open error path does NOT need cancel_work_sync() because\nINIT_WORK() only initializes the work structure - it does not schedule\nit. Work is only scheduled later during ioctl operations."
    }
  ],
  "id": "CVE-2026-46011",
  "lastModified": "2026-05-27T14:48:03.013",
  "metrics": {},
  "published": "2026-05-27T14:17:19.250",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0498b27a1542021d90269d58347501d4c3ccd84e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2209fdae5c2f615930c9af1379c1cfca199ec5d8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/26506a30e0e26d612f82a7bf0e395626968a44e6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/34c519feef3e4fcff1078dc8bdb25fbbbd10303f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e78c39f720679fcf3a2eacd82725ec3ea2648301"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-46011"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-27T14:17:19Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mtk-jpeg: fix use-after-free in release path due to uncancelled work\n\nThe mtk_jpeg_release() function frees the context structure (ctx) without\nfirst cancelling any pending or running work in ctx-\u003ejpeg_work. This\ncreates a race window where the workqueue callback may still be accessing\nthe context memory after it has been freed.\n\nRace condition:\n\n    CPU 0 (release)                    CPU 1 (workqueue)\n    ----------------                   ------------------\n    close()\n      mtk_jpeg_release()\n                                       mtk_jpegenc_worker()\n                                         ctx = work-\u003edata\n                                         // accessing ctx\n\n        kfree(ctx)  // freed!\n                                         access ctx  // UAF!\n\nThe work is queued via queue_work() during JPEG encode/decode operations\n(via mtk_jpeg_device_run). If the device is closed while work is pending\nor running, the work handler will access freed memory.\n\nFix this by calling cancel_work_sync() BEFORE acquiring the mutex. This\nordering is critical: if cancel_work_sync() is called after mutex_lock(),\nand the work handler also tries to acquire the same mutex, it would cause\na deadlock.\n\nNote: The open error path does NOT need cancel_work_sync() because\nINIT_WORK() only initializes the work structure - it does not schedule\nit. Work is only scheduled later during ioctl operations.",
  "id": "GHSA-cfrw-47v4-wfc7",
  "modified": "2026-05-27T15:33:20Z",
  "published": "2026-05-27T15:33:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46011"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0498b27a1542021d90269d58347501d4c3ccd84e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2209fdae5c2f615930c9af1379c1cfca199ec5d8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/26506a30e0e26d612f82a7bf0e395626968a44e6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/34c519feef3e4fcff1078dc8bdb25fbbbd10303f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e78c39f720679fcf3a2eacd82725ec3ea2648301"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-46011 media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46011.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "media: mtk-jpeg: fix use-after-free in release path due to uncancelled work",
    "tracking": {
      "current_release_date": "2026-05-28T14:44:32.000Z",
      "generator": {
        "date": "2026-05-29T07:23:45.789Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-46011",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-05-28T01:01:40.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-05-28T14:44:32.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.139.1-1.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.139.1-1.azl3",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "kernel"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.139.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-46011",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-46011 media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46011.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-05-28T01:01:40.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        }
      ],
      "title": "media: mtk-jpeg: fix use-after-free in release path due to uncancelled work"
    }
  ]
}