CVE-2026-46011

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: mtk-jpeg: fix use-after-free in release path due to uncancelled work

The mtk_jpeg_release() function frees the context structure (ctx) without

first cancelling any pending or running work in ctx->jpeg_work. This

creates a race window where the workqueue callback may still be accessing

the context memory after it has been freed.

Race condition:

CPU 0 (release) CPU 1 (workqueue)

---------------- ------------------

close()

mtk_jpeg_release()

mtk_jpegenc_worker()

ctx = work->data

// accessing ctx

kfree(ctx) // freed!

access ctx // UAF!

The work is queued via queue_work() during JPEG encode/decode operations

(via mtk_jpeg_device_run). If the device is closed while work is pending

or runni

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References