CVE-2026-74437

Received Received - Intake

Deadlock in Linux Kernel UVC Video Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work If a UVC camera has an asynchronous control, uvc_status_stop may be called from async_ctrl.work: uvc_ctrl_status_event_work() uvc_ctrl_status_event() uvc_ctrl_clear_handle() uvc_pm_put() uvc_status_put() uvc_status_stop() cancel_work_sync() This will cause a deadlock, since cancel_work_sync will wait for uvc_ctrl_status_event_work to complete before returning. Fix this by returning early from uvc_status_stop if we are currently in the work function. flush_status now remains false until uvc_status_start is called again, ensuring that uvc_ctrl_status_event_work won't resubmit the URB.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74437

EUVD

EUVD-2026-59584

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a deadlock in the UVC (USB Video Class) camera driver. When a UVC camera has an asynchronous control, calling uvc_status_stop from async_ctrl.work leads to a deadlock because cancel_work_sync waits for uvc_ctrl_status_event_work to finish, which cannot complete due to the deadlock.

Detection Guidance

This vulnerability is specific to the Linux kernel's UVC (USB Video Class) driver and does not have network-based detection methods. To detect if your system is affected, check the kernel version and verify if it includes the vulnerable code path. Use commands like 'uname -r' to check the kernel version and 'dmesg | grep uvcvideo' to look for UVC-related errors or deadlocks.

Impact Analysis

This vulnerability could cause system hangs or freezes when using UVC cameras with asynchronous controls. The deadlock prevents proper cleanup, potentially disrupting video capture or related applications.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a local deadlock issue in the Linux kernel's UVC video driver that could cause system hangs but does not involve data exposure, unauthorized access, or privacy violations.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If an update is not immediately available, consider disabling UVC camera support temporarily by blacklisting the uvcvideo module using 'modprobe -r uvcvideo' or adding 'blacklist uvcvideo' to /etc/modprobe.d/blacklist.conf.

Hi! I’m here to help you understand CVE-2026-74437. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70