CVE-2026-31584

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: fix use-after-free in encoder release path

The fops_vcodec_release() function frees the context structure (ctx)

without first cancelling any pending or running work in ctx->encode_work.

This creates a race window where the workqueue handler (mtk_venc_worker)

may still be accessing the context memory after it has been freed.

Race condition:

CPU 0 (release path) CPU 1 (workqueue)

--------------------- ------------------

fops_vcodec_release()

v4l2_m2m_ctx_release()

v4l2_m2m_cancel_job()

// waits for m2m job "done"

mtk_venc_worker()

v4l2_m2m_job_finish()

// m2m job "done"

// BUT worker still running!

// post-job_finish access:

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References