Към съдържанието
Търсене

CVE-2026-46011: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: fix use-after-free in release path due to uncancelled work The mtk_jpeg_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx->jpeg_work. This creates a race window where the workqueue callback may still be accessing the context memory after it has been freed. Race condition: CPU 0 (release) CPU 1 (workqueue) ---------------- ------------------ close() mtk_jpeg_release() mtk_jpegenc_worker() ctx = work->data // accessing ctx kfree(ctx) // freed! access ctx // UAF! The work is queued via queue_work() during JPEG encode/decode operations (via mtk_jpeg_device_run). If the device is closed while work is pending or running, the work handler will access freed memory. Fix this by calling cancel_work_sync() BEFORE acquiring the mutex. This ordering is critical: if cancel_work_sync() is called after mutex_lock(), and the work handler also tries to acquire the same mutex, it would cause a deadlock. Note: The open error path does NOT need cancel_work_sync() because INIT_WORK() only initializes the work structure - it does not schedule it. Work is only scheduled later during ioctl operations.

    Засегнати продукти

    • Linux Linux: 5fb1c2361e5630491d2a2f9359654eb022601bc0 преди 2209fdae5c2f615930c9af1379c1cfca199ec5d8; 5fb1c2361e5630491d2a2f9359654eb022601bc0 преди 0498b27a1542021d90269d58347501d4c3ccd84e; 5fb1c2361e5630491d2a2f9359654eb022601bc0 преди 26506a30e0e26d612f82a7bf0e395626968a44e6; 5fb1c2361e5630491d2a2f9359654eb022601bc0 преди e78c39f720679fcf3a2eacd82725ec3ea2648301; 5fb1c2361e5630491d2a2f9359654eb022601bc0 преди 34c519feef3e4fcff1078dc8bdb25fbbbd10303f
    • Linux Linux: 6.2; преди 6.2; 6.6.140 до 6.6.*; 6.12.86 до 6.12.*; 6.18.27 до 6.18.*; 7.0.4 до 7.0.*; от 7.1 нататък

    История

    • 27 май 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-46011: Linux | freedomonline.bg