Bug 2507059 (CVE-2026-64358)

Summary: CVE-2026-64358 kernel: media: mtk-jpeg: cancel workqueue on release for supported platforms only
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's media component, specifically within the `mtk-jpeg` driver. An internal function attempts to cancel a background task even when that task is not active on certain system configurations. This can lead to the system logging warning messages, potentially causing minor system instability or unexpected behavior. This issue does not result in critical security impacts such as data compromise or unauthorized code execution.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-25 10:02:54 UTC 
In the Linux kernel, the following vulnerability has been resolved:

media: mtk-jpeg: cancel workqueue on release for supported platforms only

Since a recent fix the mtk_jpeg_release function cancels any pending
or running work present in the driver workqueue using
cancel_work_sync function.
Currently, only the multicore based variants use this workqueue and they
have the jpeg_worker platform data field initialized with a workqueue
callback function. For the others, this field value remain NULL by
default.
The cancel_work_sync function is unconditionally called in
mtk_jpeg_release function, even for the variants that do not use the
workqueue. This call generates a WARN_ON print in __flush_work because
the workqueue callback function presence check fails in __flush_work
function (used by cancel_work_sync).

So, to avoid these warnings, call cancel_work_sync only if a workqueue
callback is defined in platform data.
Comment 1 Mauro Matteo Cascella 2026-07-29 22:11:01 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026072520-CVE-2026-64358-2728@gregkh/T