Skip to main content

Linux Kernel CVE-2026-64358

| EUVDEUVD-2026-48902 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-25 Linux GHSA-cj8f-pj7x-5x2c
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local trigger via device release by low-privileged user; no confidentiality or integrity impact; availability high only on panic-on-warn kernel builds.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 04, 2026 - 16:15 vuln.today
CVSS changed
Sep 04, 2026 - 16:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

media: mtk-jpeg: cancel workqueue on release for supported platforms only

Since a recent fix the mtk_jpeg_release function cancels any pending or running work present in the driver workqueue using cancel_work_sync function. Currently, only the multicore based variants use this workqueue and they have the jpeg_worker platform data field initialized with a workqueue callback function. For the others, this field value remain NULL by default. The cancel_work_sync function is unconditionally called in mtk_jpeg_release function, even for the variants that do not use the workqueue. This call generates a WARN_ON print in __flush_work because the workqueue callback function presence check fails in __flush_work function (used by cancel_work_sync).

So, to avoid these warnings, call cancel_work_sync only if a workqueue callback is defined in platform data.

AnalysisAI

Unconditional invocation of cancel_work_sync() in the mtk-jpeg media driver's release path triggers spurious WARN_ON kernel warnings on non-multicore MediaTek JPEG codec platforms where the workqueue callback pointer is NULL. Systems running affected Linux kernel versions (6.6.140-6.18.38, 7.0.4) on MediaTek SoC hardware may experience kernel log pollution or, on kernels compiled with CONFIG_PANIC_ON_WARN=y, a full system denial of service when the JPEG device is released. No public exploit has been identified and no active exploitation is recorded; this is a stability and correctness fix with strictly local trigger conditions.

Technical ContextAI

The MediaTek JPEG (mtk-jpeg) driver in the Linux kernel supports two hardware variants: a legacy single-core path and a newer multicore path. Only the multicore variant initializes the jpeg_worker platform data field with a workqueue callback function; the single-core variant leaves this field as NULL by default. A prior fix introduced a cancel_work_sync() call in mtk_jpeg_release() to drain pending work on teardown, but this call was made unconditional. When cancel_work_sync() is invoked on a zero-initialized work_struct (non-multicore variant), the internal __flush_work helper detects the missing function pointer and fires WARN_ON - consistent with CWE-476 (NULL Pointer Dereference). The kernel subsystem is the V4L2/media layer; affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. The correct fix guards the cancel_work_sync call behind a NULL check on the jpeg_worker callback pointer.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 6.6.145, 6.12.96, 6.18.39, or 7.1 (or any subsequent release). Fix commits are available at git.kernel.org: 0fed0fc34ce7 (6.12 branch), ac0774961a6e (7.0 branch), 973408ceab14 (6.18 branch), 4c4b4af4a9f2 (6.12 branch), and b1845a227fda (6.6 branch). For embedded or Android platforms where immediate kernel upgrade is not feasible, removing or blocklisting the mtk-jpeg kernel module (if JPEG hardware is not operationally required) eliminates the affected code path entirely with the trade-off of losing hardware JPEG acceleration. Where the module is built-in, restricting unprivileged access to /dev/video* JPEG device nodes via udev rules or SELinux/AppArmor policy limits exposure to privilege-holding processes. Full advisory references: https://nvd.nist.gov/vuln/detail/CVE-2026-64358 and https://vuldb.com/vuln/383155.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

CVE-2026-64358 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy