CVE-2026-74437: media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work
In the Linux kernel, the following vulnerability has been resolved:
media: uvcvideo: Fix deadlock if uvcstatusstop is called from asyncctrl.work
If a UVC camera has an asynchronous control, uvcstatusstop may be called from asyncctrl.work:
uvcctrlstatuseventwork() uvcctrlstatusevent() uvcctrlclearhandle() uvcpmput() uvcstatusput() uvcstatusstop() cancelworksync()
This will cause a deadlock, since cancelworksync will wait for uvcctrlstatuseventwork to complete before returning.
Fix this by returning early from uvcstatusstop if we are currently in the work function. flushstatus now remains false until uvcstatusstart is called again, ensuring that uvcctrlstatuseventwork won't resubmit the URB.