CVE-2026-64358: Linux Kernel mtk-jpeg Driver Vulnerability

CVE-2026-64358 Overview

CVE-2026-64358 affects the Linux kernel's MediaTek JPEG media driver (mtk-jpeg). The mtk_jpeg_release function unconditionally calls cancel_work_sync on the driver workqueue during release. Only multicore-based variants initialize the jpeg_worker platform data field with a valid workqueue callback. On non-multicore platforms this field remains NULL, causing __flush_work to emit a WARN_ON when invoked through cancel_work_sync. The fix restricts the cancel_work_sync call to variants where a workqueue callback is defined in platform data.

Critical Impact
The issue produces kernel warnings on affected MediaTek platforms during JPEG device release, indicating an invalid workqueue state check. It does not enable remote code execution or privilege escalation.

Affected Products

Linux kernel builds including the MediaTek JPEG (mtk-jpeg) media driver
MediaTek SoC platforms using non-multicore JPEG variants without jpeg_worker initialization
Downstream distributions shipping the affected media subsystem code prior to the fix

Discovery Timeline

2026-07-25 - CVE-2026-64358 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64358

Vulnerability Analysis

The MediaTek JPEG driver uses a workqueue to defer JPEG decode work on multicore SoC variants. The mtk_jpeg_release function releases device resources when userspace closes the device. A prior fix added an unconditional call to cancel_work_sync to drain pending work during release.

Only multicore variants populate the jpeg_worker field in platform data with a workqueue callback. Non-multicore variants leave this field as NULL. When mtk_jpeg_release invokes cancel_work_sync on these platforms, the internal __flush_work routine fails its callback presence check and emits a WARN_ON. This produces kernel log noise and a stack trace during normal device close operations.

The defect is a correctness and reliability issue in kernel driver state handling rather than a memory safety flaw. No CWE has been assigned. No CVSS score has been published.

Root Cause

The root cause is missing platform capability validation before invoking cancel_work_sync. The mtk_jpeg_release function assumed all variants used the workqueue path. Because jpeg_worker is an optional platform data field, the release path must check for its presence before attempting workqueue cancellation.

Attack Vector

The issue is triggered by legitimate device release operations on non-multicore MediaTek JPEG hardware. No remote or local attacker interaction is required. Impact is limited to kernel log warnings and does not affect the confidentiality, integrity, or availability of user data. See the upstream commits linked in the references for the exact code paths involved.

// No verified exploit code available.
// The condition manifests when mtk_jpeg_release() calls
// cancel_work_sync() on a variant where platform data
// jpeg_worker == NULL, causing __flush_work to WARN_ON.

Detection Methods for CVE-2026-64358

Indicators of Compromise

Kernel log entries containing WARN_ON originating from __flush_work during device close of /dev/videoN MediaTek JPEG nodes
Stack traces referencing mtk_jpeg_release and cancel_work_sync in dmesg output
Repeated warnings correlated with userspace applications opening and closing the MediaTek JPEG device

Detection Strategies

Monitor dmesg and journalctl -k for WARN_ON traces referencing mtk_jpeg_release or __flush_work
Correlate warning frequency with running kernel version and MediaTek SoC variant to confirm exposure
Track kernel version inventory across MediaTek-based devices to identify unpatched builds

Monitoring Recommendations

Forward kernel logs from MediaTek Linux devices to a centralized logging pipeline for WARN_ON pattern matching
Alert on repeated occurrences of the __flush_work warning to identify affected fleets
Review kernel package versions during routine configuration audits to confirm the fix is applied

How to Mitigate CVE-2026-64358

Immediate Actions Required

Apply the upstream kernel patches referenced in the Linux kernel stable tree commits that guard cancel_work_sync with a jpeg_worker presence check
Rebuild and deploy the kernel on affected MediaTek platforms after applying the fix
Validate that WARN_ON traces no longer appear during JPEG device release operations

Patch Information

Fixes are available in the mainline and stable Linux kernel trees. Refer to the following commits: commit 0fed0fc3, commit 4c4b4af4, commit 973408ce, commit ac077496, and commit b1845a22. Distribution vendors should backport these fixes to supported kernel branches.

Workarounds

Suppress or filter the specific WARN_ON message in log analysis tooling if patch deployment is delayed, while continuing to plan the kernel update
Avoid deploying non-multicore MediaTek JPEG variants on affected kernel builds where log noise causes operational issues

bash

# Verify installed kernel version on affected MediaTek devices
uname -r

# Search for the WARN_ON indicator in kernel logs
dmesg | grep -E 'mtk_jpeg_release|__flush_work'

# After applying the patch, confirm no warnings appear on device close
journalctl -k --since "1 hour ago" | grep -i warn