CVE-2026-46058: media: amphion: Fix race between m2m job_abort and device_run
In the Linux kernel, the following vulnerability has been resolved:
media: amphion: Fix race between m2m jobabort and devicerun
Fix kernel panic caused by race condition where v4l2m2mctxrelease() frees m2mctx while v4l2m2mtryrun() is about to call devicerun with the same context.
Race sequence: v4l2m2mtryrun(): v4l2m2mctxrelease(): lock/unlock v4l2m2mcanceljob() jobabort() v4l2m2mjobfinish() kfree(m2mctx) <- frees ctx devicerun() <- use-after-free crash at 0x538
Crash trace: Unable to handle kernel read from unreadable memory at virtual address 0000000000000538 v4l2m2mtryrun+0x78/0x138 v4l2m2mdevicerunwork+0x14/0x20
The amphion vpu driver does not rely on the m2m framework's devicerun callback to perform encode/decode operations.
Fix the race by preventing m2m framework job scheduling entirely: - Add jobready callback returning 0 (no jobs ready for m2m framework) - Remove jobabort callback to avoid the race condition
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
Prevent m2m framework job scheduling entirely by adding/updating the amphion VPU driver's m2m framework job_ready callback to return 0 (no jobs ready for the m2m framework).
amphion VPU driver (Linux kernel) job_ready callback = return 0 - Configuration
Remove the amphion VPU driver's m2m framework job_abort callback to avoid the race condition between m2m job_abort and device_run/use-after-free.
amphion VPU driver (Linux kernel) job_abort callback = removed
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel's Amphion VPU media driver are exposed. The affected software list specifically includes the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1.
What access does an attacker need to exploit it?
The supplied severity vector indicates local access and low privileges are required, with no user interaction. Successful exploitation can affect confidentiality, integrity, and availability.
What happens if the race is triggered?
The race can cause a use-after-free when an m2m context is freed while the framework is about to invoke device_run. The documented outcome is a kernel panic caused by an invalid memory read.
What change resolves the issue?
The fix prevents m2m framework job scheduling in the Amphion driver by adding a job_ready callback that returns 0. It also removes the job_abort callback, eliminating the race between job abort and device_run.