CVE-2026-46058: Linux Kernel Race Condition Vulnerability

CVE-2026-46058 Overview

CVE-2026-46058 is a race condition vulnerability in the Linux kernel amphion Video Processing Unit (VPU) media driver. The flaw occurs between the Memory-to-Memory (M2M) framework callbacks job_abort and device_run. A race in v4l2_m2m_ctx_release() frees the m2m_ctx structure while v4l2_m2m_try_run() is preparing to invoke device_run with that same context. The result is a kernel use-after-free that triggers a panic when the freed pointer is dereferenced.

Critical Impact
Local users can trigger a kernel panic and use-after-free in the amphion VPU driver, leading to denial of service and potential memory corruption.

Affected Products

Linux kernel media: amphion VPU driver
Kernel versions containing the amphion job_abort callback prior to the fix
Distributions shipping the affected stable kernel branches

Discovery Timeline

2026-05-27 - CVE-2026-46058 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46058

Vulnerability Analysis

The vulnerability lives in the interaction between the V4L2 M2M framework and the amphion VPU driver. The M2M framework schedules jobs by calling driver callbacks such as job_ready, job_abort, and device_run. The amphion driver registered a job_abort callback but did not rely on device_run for actual encode and decode operations.

When v4l2_m2m_ctx_release() runs concurrently with v4l2_m2m_try_run(), the release path cancels the pending job, calls job_abort(), which in turn calls v4l2_m2m_job_finish(), and then frees the context with kfree(m2m_ctx). The other thread, already past the locking window in v4l2_m2m_try_run(), then dereferences the freed context inside device_run(). The reported crash shows a kernel read from address 0x538 at v4l2_m2m_try_run+0x78/0x138 invoked from v4l2_m2m_device_run_work.

Root Cause

The root cause is a lifetime management gap between the M2M scheduler and the amphion driver. The scheduler can drop its internal lock after deciding a job is runnable but before the driver callback executes. If the context owner releases the M2M context in that window, the device_run callback runs against freed memory. The amphion driver compounded the issue by participating in M2M job scheduling that it did not functionally need.

Attack Vector

An attacker with local access to an affected /dev/video* device can race file descriptor close operations against active encode or decode workloads to trigger the use-after-free. Reliable triggering requires the ability to open the amphion VPU device and submit M2M jobs. Successful exploitation crashes the kernel; memory corruption primitives from use-after-free conditions can in some cases be developed into privilege escalation.

The fix removes amphion participation in M2M job scheduling. The driver now provides a job_ready callback that always returns 0, telling the M2M framework no jobs are ever ready, and removes the job_abort callback entirely. This eliminates the race window because device_run is no longer reachable through the M2M scheduler. See the Kernel Git Commit fdc150da for the upstream change.

Detection Methods for CVE-2026-46058

Indicators of Compromise

Kernel oops or panic messages referencing v4l2_m2m_try_run and v4l2_m2m_device_run_work in dmesg or /var/log/kern.log.
Reads from low virtual addresses such as 0x538 originating in V4L2 M2M call paths.
Unexpected restarts of services or processes that interact with /dev/video* amphion devices.

Detection Strategies

Audit running kernel versions against the fixed commits referenced in the upstream advisory to identify unpatched hosts.
Monitor for repeated abnormal terminations of media processing workloads consuming the amphion VPU.
Correlate crash dumps and kdump artifacts against the call traces published with the patch.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on V4L2 M2M backtraces.
Track access patterns to amphion VPU device nodes and flag rapid open/close sequences from unprivileged users.
Watch for kernel panics on systems running NXP i.MX 8M Plus and similar SoCs that ship the amphion driver.

How to Mitigate CVE-2026-46058

Immediate Actions Required

Update affected systems to a kernel build that includes the upstream amphion fix.
On systems where patching is not yet possible, restrict access to /dev/video* nodes exposed by the amphion driver to trusted users only.
Inventory embedded and edge devices using NXP VPU silicon and prioritize firmware or kernel updates from the vendor.

Patch Information

The issue is resolved by removing the job_abort callback and adding a job_ready callback returning 0 in the amphion driver. Upstream fixes are available in the following commits: Kernel Git Commit 42dc622, Kernel Git Commit 6be2cb7, Kernel Git Commit 8cd35ce, Kernel Git Commit da4f46c, and Kernel Git Commit fdc150da.

Workarounds

Unload the amphion kernel module on systems that do not require hardware video encode or decode.
Tighten device node permissions so only privileged service accounts can open amphion VPU devices.
Disable user-facing media services that exercise the amphion M2M code paths until patched kernels are deployed.

bash

# Restrict access to amphion VPU device nodes and unload module if unused
sudo chmod 0660 /dev/video*
sudo chown root:video /dev/video*
sudo modprobe -r amphion_vpu  # only if no media workloads depend on it