CVE-2026-46058

media: amphion: Fix race between m2m job_abort and device_run

High · published May 27, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
2.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

media: amphion: Fix race between m2m job_abort and device_run

Fix kernel panic caused by race condition where v4l2_m2m_ctx_release()

frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run

with the same context.

Race sequence:

v4l2_m2m_try_run(): v4l2_m2m_ctx_release():

lock/unlock v4l2_m2m_cancel_job()

job_abort()

v4l2_m2m_job_finish()

kfree(m2m_ctx) <- frees ctx

device_run() <- use-after-free crash at 0x538

Crash trace:

Unable to handle kernel read from unreadable memory at virtual address

0000000000000538

v4l2_m2m_try_run+0x78/0x138

v4l2_m2m_device_run_work+0x14/0x20

The amphion vpu driver does not rely on the m2m framework's device_run

callback to perform encode/decode operations.

Fix the race by preventing m2m framework job scheduling entirely:

- Add job_ready callback returning 0 (no jobs ready for m2m framework)

- Remove job_abort callback to avoid the race condition

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00132 · 2.5th percentile
Published
2026-05-27T12:57Z
EPSS history
Timeline
  • 27 MAY 12:57Z
    media: amphion: Fix race between m2m job_abort and device_run
    cvelistv5