High 7.8Published May 27, 2026

CVE-2026-46058media: amphion: Fix race between m2m job_abort and device_run

Updated under an hour ago (Oct 26, 2026, 11:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: media: amphion: Fix race between m2m job_abort and device_run Fix kernel panic caused by race condition where v4l2_m2m_ctx_release() frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run with the same context. Race sequence: v4l2_m2m_try_run(): v4l2_m2m_ctx_release(): lock/unlock v4l2_m2m_cancel_job() job_abort() v4l2_m2m_job_finish() kfree(m2m_ctx) <- frees ctx device_run() <- use-after-free crash at 0x538 Crash trace: Unable to handle kernel read from unreadable memory at virtual address 0000000000000538 v4l2_m2m_try_run+0x78/0x138 v4l2_m2m_device_run_work+0x14/0x20 The amphion vpu driver does not rely on the m2m framework's device_run callback to perform encode/decode operations. Fix the race by preventing m2m framework job scheduling entirely: - Add job_ready callback returning 0 (no jobs ready for m2m framework) - Remove job_abort callback to avoid the race condition

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 3cd084519c6f91cbef9d604bcf26844fa81d4922 before 516467052fdfc6a13eadc70d43420ae57436bf3c; from 3cd084519c6f91cbef9d604bcf26844fa81d4922 before 42dc622776f3ce1a6c31b13bdc686f7295e3b323; from 3cd084519c6f91cbef9d604bcf26844fa81d4922 before da4f46c5cf1d26e6b09418ad453e152f2e75a02c; from 3cd084519c6f91cbef9d604bcf26844fa81d4922 before fdc150dac1adb9a98be9d6956cff0348838b024a; from 3cd084519c6f91cbef9d604bcf26844fa81d4922 before 6be2cb75bc1300080cfc8051579f22efae9401f7; from 3cd084519c6f91cbef9d604bcf26844fa81d4922 before 8cd35ceadcfc8c5da2eb7f7ce24525ce9d4ee62e	CNA record
linux linux_kernel linux:linux_kernel	from 5.18 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4	NVD

References

References

https://git.kernel.org/stable/c/516467052fdfc6a13eadc70d43420ae57436bf3c	patch
https://git.kernel.org/stable/c/42dc622776f3ce1a6c31b13bdc686f7295e3b323	patch
https://git.kernel.org/stable/c/da4f46c5cf1d26e6b09418ad453e152f2e75a02c	patch
https://git.kernel.org/stable/c/fdc150dac1adb9a98be9d6956cff0348838b024a	patch
https://git.kernel.org/stable/c/6be2cb75bc1300080cfc8051579f22efae9401f7	patch
https://git.kernel.org/stable/c/8cd35ceadcfc8c5da2eb7f7ce24525ce9d4ee62e	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.