CVE-2026-64358
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtk_jpeg_release function cancels any pending or running work present in the driver workqueue using cancel_work_sync function. Currently, only the multicore based variants use this workqueue and they have the jpeg_worker platform data field initialized with a workqueue callback function. For the others, this field value remain NULL by default. The cancel_work_sync function is unconditionally called in mtk_jpeg_release function, even for the variants that do not use the workqueue. This call generates a WARN_ON print in __flush_work because the workqueue callback function presence check fails in __flush_work function (used by cancel_work_sync). So, to avoid these warnings, call cancel_work_sync only if a workqueue callback is defined in platform data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64358
EUVD
EUVD-2026-48902

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's media driver for MediaTek JPEG hardware. It occurs in the mtk_jpeg_release function which incorrectly calls cancel_work_sync even for hardware variants that do not use a workqueue. This causes a warning in the kernel when the workqueue callback is missing.

Detection Guidance

This vulnerability manifests as a WARN_ON warning in the kernel logs when cancel_work_sync is called on a workqueue without a callback. Check kernel logs for messages like __flush_work or WARN_ON related to mtk-jpeg or workqueue operations.

Impact Analysis

This vulnerability primarily impacts system stability by generating kernel warnings. It does not directly cause security issues but may affect performance or cause log noise. Users might see WARN_ON messages in system logs.

Mitigation Strategies

Apply the kernel patch that ensures cancel_work_sync is only called when a workqueue callback is defined. Update to a fixed kernel version where this issue is resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64358. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart