CVE-2026-64358

Analyzed Analyzed - Analysis Complete

Kernel Workqueue Cancellation Fix in MediaTek JPEG Driver

Publication date: 2026-07-25

Last updated on: 2026-09-04

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtk_jpeg_release function cancels any pending or running work present in the driver workqueue using cancel_work_sync function. Currently, only the multicore based variants use this workqueue and they have the jpeg_worker platform data field initialized with a workqueue callback function. For the others, this field value remain NULL by default. The cancel_work_sync function is unconditionally called in mtk_jpeg_release function, even for the variants that do not use the workqueue. This call generates a WARN_ON print in __flush_work because the workqueue callback function presence check fails in __flush_work function (used by cancel_work_sync). So, to avoid these warnings, call cancel_work_sync only if a workqueue callback is defined in platform data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-04

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64358

EUVD

EUVD-2026-48902

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.12.86 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.18.27 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.6.140 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 7.0.4 (inc) to 7.1.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's media driver for MediaTek JPEG hardware. It occurs in the mtk_jpeg_release function which incorrectly calls cancel_work_sync even for hardware variants that do not use a workqueue. This causes a warning in the kernel when the workqueue callback is missing.

Detection Guidance

This vulnerability manifests as a WARN_ON warning in the kernel logs when cancel_work_sync is called on a workqueue without a callback. Check kernel logs for messages like __flush_work or WARN_ON related to mtk-jpeg or workqueue operations.

Impact Analysis

This vulnerability primarily impacts system stability by generating kernel warnings. It does not directly cause security issues but may affect performance or cause log noise. Users might see WARN_ON messages in system logs.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel issue related to workqueue handling in the mtk-jpeg driver, causing warnings but not impacting data security or privacy.

Mitigation Strategies

Apply the kernel patch that ensures cancel_work_sync is only called when a workqueue callback is defined. Update to a fixed kernel version where this issue is resolved.

Hi! I’m here to help you understand CVE-2026-64358. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70