https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:00:40 +0000 https://vulnerability.circl.lu/vuln/cve-2026-31584 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: mediatek: vcodec: fix use-after-free in encoder release path</p> <p>The fops_vcodec_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx-&gt;encode_work. This creates a race window where the workqueue handler (mtk_venc_worker) may still be accessing the context memory after it has been freed.</p> <p>Race condition:</p> <p>CPU 0 (release path) CPU 1 (workqueue) --------------------- ------------------ fops_vcodec_release() v4l2_m2m_ctx_release() v4l2_m2m_cancel_job() // waits for m2m job &#34;done&#34; mtk_venc_worker() v4l2_m2m_job_finish() // m2m job &#34;done&#34; // BUT worker still running! // post-job_finish access: other ctx dereferences // UAF if ctx already freed // returns (job &#34;done&#34;) kfree(ctx) // ctx freed</p> <p>Root cause: The v4l2_m2m_ctx_release() only waits for the m2m job lifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle. After v4l2_m2m_job_finish() is called, the m2m framework considers the job complete and v4l2_m2m_ctx_release() returns, but the worker function continues executing and may s…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: mediatek: vcodec: fix use-after-free in encoder release path</p> <p>The fops_vcodec_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx-&gt;encode_work. This creates a race window where the workqueue handler (mtk_venc_worker) may still be accessing the context memory after it has been freed.</p> <p>Race condition:</p> <p>CPU 0 (release path) CPU 1 (workqueue) --------------------- ------------------ fops_vcodec_release() v4l2_m2m_ctx_release() v4l2_m2m_cancel_job() // waits for m2m job &#34;done&#34; mtk_venc_worker() v4l2_m2m_job_finish() // m2m job &#34;done&#34; // BUT worker still running! // post-job_finish access: other ctx dereferences // UAF if ctx already freed // returns (job &#34;done&#34;) kfree(ctx) // ctx freed</p> <p>Root cause: The v4l2_m2m_ctx_release() only waits for the m2m job lifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle. After v4l2_m2m_job_finish() is called, the m2m framework considers the job complete and v4l2_m2m_ctx_release() returns, but the worker function continues executing and may s…</p> https://vulnerability.circl.lu/vuln/cve-2026-31584