CVE-2026-46058

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: amphion: Fix race between m2m job_abort and device_run

Fix kernel panic caused by race condition where v4l2_m2m_ctx_release()

frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run

with the same context.

Race sequence:

v4l2_m2m_try_run(): v4l2_m2m_ctx_release():

lock/unlock v4l2_m2m_cancel_job()

job_abort()

v4l2_m2m_job_finish()

kfree(m2m_ctx) <- frees ctx

device_run() <- use-after-free crash at 0x538

Crash trace:

Unable to handle kernel read from unreadable memory at virtual address

0000000000000538

v4l2_m2m_try_run+0x78/0x138

v4l2_m2m_device_run_work+0x14/0x20

The amphion vpu driver does not rely on the m2m framework's device_run

callback to perform encode/decode operations.

Fix the race by preventing m2m framework job scheduling entirely:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References