Executive brief
A stability issue was identified in the Linux kernel's MediaTek JPEG driver. On certain hardware configurations, the system would attempt to perform cleanup tasks for features that were not active, leading to internal system warnings and potential instability. This primarily affects devices using MediaTek processors for image processing.
Technical details
A vulnerability in the mtk-jpeg driver was resolved where mtk_jpeg_release unconditionally called cancel_work_sync() on the context's workqueue. On non-multicore variants of the MediaTek JPEG hardware, the jpeg_worker platform data field is NULL, causing __flush_work() to trigger a WARN_ON because the workqueue callback check fails. This issue was introduced by a previous fix intended to prevent use-after-free scenarios. The fix adds a conditional check to ensure cancel_work_sync() is only invoked if a workqueue callback is actually defined for the specific hardware variant.
Affected products
- Linux Linux Kernel 6.6.140 to 6.6.145, 6.12.86 to 6.12.96, 6.18.27 to 6.18.39, 7.0.4 to 7.1
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory
References
- https://git.kernel.org/stable/c/0fed0fc34ce734b4b8c2f6a467d38bddcb21dda9
- https://git.kernel.org/stable/c/4c4b4af4a9f278da096f0dbdb6b59594701d29bf
- https://git.kernel.org/stable/c/973408ceab14555a8548b97c8cc7b54208c3f251
- https://git.kernel.org/stable/c/ac0774961a6ea174a71d4ffa39966edafbf7662d
- https://git.kernel.org/stable/c/b1845a227fda37b2fe5327df3ca0015d7e290235