https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:19:34 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-12574 bdu:2026-12574 https://cve.radiocsirt.org/vuln/bdu:2026-12574 https://cve.radiocsirt.org/vuln/bell-cve-2026-31584 <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-31584 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0548 certfr-2026-avi-0548 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0548 https://cve.radiocsirt.org/vuln/euvd-2026-347722 EUVD-2026-347722 https://cve.radiocsirt.org/vuln/euvd-2026-347722 https://cve.radiocsirt.org/vuln/fkie_cve-2026-31584 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: mediatek: vcodec: fix use-after-free in encoder release path</p> <p>The fops_vcodec_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx-&gt;encode_work. This creates a race window where the workqueue handler (mtk_venc_worker) may still be accessing the context memory after it has been freed.</p> <p>Race condition:</p> <p>CPU 0 (release path) CPU 1 (workqueue) --------------------- ------------------ fops_vcodec_release() v4l2_m2m_ctx_release() v4l2_m2m_cancel_job() // waits for m2m job &#34;done&#34; mtk_venc_worker() v4l2_m2m_job_finish() // m2m job &#34;done&#34; // BUT worker still running! // post-job_finish access: other ctx dereferences // UAF if ctx already freed // returns (job &#34;done&#34;) kfree(ctx) // ctx freed</p> <p>Root cause: The v4l2_m2m_ctx_release() only waits for the m2m job lifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle. After v4l2_m2m_job_finish() is called, the m2m framework considers the job complete and v4l2_m2m_ctx_release() returns, but the worker function continues executing and may s…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: mediatek: vcodec: fix use-after-free in encoder release path</p> <p>The fops_vcodec_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx-&gt;encode_work. This creates a race window where the workqueue handler (mtk_venc_worker) may still be accessing the context memory after it has been freed.</p> <p>Race condition:</p> <p>CPU 0 (release path) CPU 1 (workqueue) --------------------- ------------------ fops_vcodec_release() v4l2_m2m_ctx_release() v4l2_m2m_cancel_job() // waits for m2m job &#34;done&#34; mtk_venc_worker() v4l2_m2m_job_finish() // m2m job &#34;done&#34; // BUT worker still running! // post-job_finish access: other ctx dereferences // UAF if ctx already freed // returns (job &#34;done&#34;) kfree(ctx) // ctx freed</p> <p>Root cause: The v4l2_m2m_ctx_release() only waits for the m2m job lifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle. After v4l2_m2m_job_finish() is called, the m2m framework considers the job complete and v4l2_m2m_ctx_release() returns, but the worker function continues executing and may s…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-31584 https://cve.radiocsirt.org/vuln/ghsa-5g36-g7f3-8q34 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: mediatek: vcodec: fix use-after-free in encoder release path</p> <p>The fops_vcodec_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx-&gt;encode_work. This creates a race window where the workqueue handler (mtk_venc_worker) may still be accessing the context memory after it has been freed.</p> <p>Race condition:</p> <p>CPU 0 (release path) CPU 1 (workqueue) --------------------- ------------------ fops_vcodec_release() v4l2_m2m_ctx_release() v4l2_m2m_cancel_job() // waits for m2m job &#34;done&#34; mtk_venc_worker() v4l2_m2m_job_finish() // m2m job &#34;done&#34; // BUT worker still running! // post-job_finish access: other ctx dereferences // UAF if ctx already freed // returns (job &#34;done&#34;) kfree(ctx) // ctx freed</p> <p>Root cause: The v4l2_m2m_ctx_release() only waits for the m2m job lifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle. After v4l2_m2m_job_finish() is called, the m2m framework considers the job complete and v4l2_m2m_ctx_release() returns, but the worker function continues executing and may s…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: mediatek: vcodec: fix use-after-free in encoder release path</p> <p>The fops_vcodec_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx-&gt;encode_work. This creates a race window where the workqueue handler (mtk_venc_worker) may still be accessing the context memory after it has been freed.</p> <p>Race condition:</p> <p>CPU 0 (release path) CPU 1 (workqueue) --------------------- ------------------ fops_vcodec_release() v4l2_m2m_ctx_release() v4l2_m2m_cancel_job() // waits for m2m job &#34;done&#34; mtk_venc_worker() v4l2_m2m_job_finish() // m2m job &#34;done&#34; // BUT worker still running! // post-job_finish access: other ctx dereferences // UAF if ctx already freed // returns (job &#34;done&#34;) kfree(ctx) // ctx freed</p> <p>Root cause: The v4l2_m2m_ctx_release() only waits for the m2m job lifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle. After v4l2_m2m_job_finish() is called, the m2m framework considers the job complete and v4l2_m2m_ctx_release() returns, but the worker function continues executing and may s…</p> https://cve.radiocsirt.org/vuln/ghsa-5g36-g7f3-8q34 https://cve.radiocsirt.org/vuln/msrc_cve-2026-31584 msrc_CVE-2026-31584 https://cve.radiocsirt.org/vuln/msrc_cve-2026-31584 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10703-1 <p>kernel-devel-7.0.3-1.1 on GA media</p> <p>kernel-devel-7.0.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10703-1 https://cve.radiocsirt.org/vuln/suse-su-2026:22099-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22099-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-31584 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 152 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: fix use-after-free in encoder release path The fops_vcodec_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx-&gt;encode_work. This creates a race window where the workqueue handler (mtk_venc_worker) may still be accessing the context memory after it has been freed. Race condition: CPU 0 (release path) CPU 1 (workqueue) --------------------- ------------------ fops_vcodec_release() v4l2_m2m_ctx_release() v4l2_m2m_cancel_job() // waits for m2m job &#34;done&#34; mtk_venc_worker() v4l2_m2m_job_finish() // m2m job &#34;done&#34; // BUT worker still running! // post-job_finish access: other ctx dereferences // UAF if ctx already freed // returns (job &#34;done&#34;) kfree(ctx) // ctx freed Root cause: The v4l2_m2m_ctx_release() only waits for the m2m job lifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle. After v4l2_m2m_job_finish() is called, the m2m framework considers the job complete and v4l2_m2m_ctx_release() returns, but the worker function continues executing and may still…</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 152 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: fix use-after-free in encoder release path The fops_vcodec_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx-&gt;encode_work. This creates a race window where the workqueue handler (mtk_venc_worker) may still be accessing the context memory after it has been freed. Race condition: CPU 0 (release path) CPU 1 (workqueue) --------------------- ------------------ fops_vcodec_release() v4l2_m2m_ctx_release() v4l2_m2m_cancel_job() // waits for m2m job &#34;done&#34; mtk_venc_worker() v4l2_m2m_job_finish() // m2m job &#34;done&#34; // BUT worker still running! // post-job_finish access: other ctx dereferences // UAF if ctx already freed // returns (job &#34;done&#34;) kfree(ctx) // ctx freed Root cause: The v4l2_m2m_ctx_release() only waits for the m2m job lifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle. After v4l2_m2m_job_finish() is called, the m2m framework considers the job complete and v4l2_m2m_ctx_release() returns, but the worker function continues executing and may still…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-31584 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1279 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, welche zu einem Denial-of-Service-Zustand, einer Rechteausweitung, der Ausführung von Code oder einer Speicherbeschädigung führen könnten.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, welche zu einem Denial-of-Service-Zustand, einer Rechteausweitung, der Ausführung von Code oder einer Speicherbeschädigung führen könnten.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1279