CVE-2026-46011 Overview
CVE-2026-46011 is a use-after-free vulnerability in the Linux kernel's MediaTek JPEG (mtk-jpeg) media driver. The flaw resides in the mtk_jpeg_release() function, which frees the driver context structure (ctx) without first cancelling pending or running workqueue items in ctx->jpeg_work. A race window allows the mtk_jpegenc_worker() callback to dereference context memory after it has been released, leading to kernel memory corruption. The issue has been resolved upstream by introducing a cancel_work_sync() call before the mutex acquisition in the release path.
Critical Impact
A local attacker with access to the MediaTek JPEG codec device can trigger a use-after-free condition during device close, potentially leading to kernel memory corruption, privilege escalation, or denial of service.
Affected Products
- Linux kernel versions containing the mtk-jpeg media driver prior to the fix
- Systems using MediaTek SoCs with hardware JPEG encode/decode acceleration
- Distributions shipping unpatched Linux kernels referenced in the upstream stable commits
Discovery Timeline
- 2026-05-27 - CVE-2026-46011 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46011
Vulnerability Analysis
The vulnerability is a classic use-after-free (UAF) race condition between a file release handler and a deferred workqueue callback in the MediaTek JPEG V4L2 driver. During normal operation, JPEG encode and decode operations queue work items via queue_work() inside mtk_jpeg_device_run(). Each work item retains a pointer to the per-file driver context (ctx).
When userspace closes the device, mtk_jpeg_release() executes and calls kfree(ctx) to release the context. The release path does not call cancel_work_sync(), so any in-flight mtk_jpegenc_worker() invocation continues to read fields from the now-freed ctx structure. The result is kernel heap corruption with attacker-influenced timing.
Root Cause
The root cause is missing lifecycle synchronization between the workqueue producer and the release path. The driver initializes work with INIT_WORK() and schedules it during ioctl-driven encode and decode operations, yet the release function does not drain pending work before freeing the backing memory. The work handler dereferences work->data to recover the context pointer, which becomes a dangling reference once kfree(ctx) completes.
Attack Vector
A local user with permission to open the MediaTek JPEG /dev/videoX node can trigger the race by issuing JPEG encode or decode ioctls and then closing the file descriptor while work is still pending. Repeated attempts increase the chance of overlapping the worker thread with kfree(). Successful exploitation corrupts kernel memory, which an attacker can leverage for privilege escalation or system instability.
No verified public exploit code is available for this issue. The vulnerability mechanism is documented in the upstream Linux kernel commit messages referenced below.
Detection Methods for CVE-2026-46011
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing mtk_jpegenc_worker, mtk_jpeg_release, or process_one_work in dmesg and /var/log/kern.log.
- KASAN reports flagging use-after-free reads or writes inside the mtk-jpeg driver context.
- Workqueue stalls or repeated soft lockups on systems running MediaTek media workloads.
Detection Strategies
- Enable CONFIG_KASAN on test kernels to catch the use-after-free at runtime before production deployment.
- Audit running kernel versions against the fixed commits listed in the upstream references to confirm exposure.
- Monitor V4L2 device usage patterns for unusual open and close cycles concurrent with JPEG ioctl traffic.
Monitoring Recommendations
- Forward kernel ring buffer events to a centralized logging platform and alert on crash signatures touching the mtk-jpeg symbol space.
- Track Linux kernel package versions across the fleet to identify hosts still running pre-patch builds.
- Correlate process termination events for media-related userspace clients with kernel error signatures.
How to Mitigate CVE-2026-46011
Immediate Actions Required
- Update affected Linux kernels to a version that includes the upstream fix, which adds cancel_work_sync() before the mutex in mtk_jpeg_release().
- Restrict access to MediaTek JPEG device nodes by tightening permissions on /dev/video* to trusted user groups only.
- Rebuild and redeploy custom kernels for embedded MediaTek platforms to incorporate the stable backports.
Patch Information
The vulnerability is resolved by cancelling any pending work before freeing the context. The fix is applied across multiple stable branches as documented in the following upstream commits: Linux Kernel Commit 0498b27a, Linux Kernel Commit 2209fdae, Linux Kernel Commit 26506a30, Linux Kernel Commit 34c519fe, and Linux Kernel Commit e78c39f7. The fix calls cancel_work_sync() before acquiring the driver mutex to avoid deadlock with worker code that also takes the mutex.
Workarounds
- Disable or unload the mtk-jpeg kernel module on systems that do not require hardware JPEG acceleration.
- Remove or restrict the CONFIG_VIDEO_MEDIATEK_JPEG build option when compiling custom kernels for affected platforms.
- Limit exposure by ensuring only privileged processes can open MediaTek media device nodes until patches are deployed.
# Restrict access to MediaTek JPEG device nodes
sudo chgrp video /dev/video*
sudo chmod 660 /dev/video*
# Optionally blacklist the driver if hardware JPEG is not required
echo 'blacklist mtk_jpeg' | sudo tee /etc/modprobe.d/blacklist-mtk-jpeg.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
