Answer in brief
CVE-2026-64358 records a Medium severity (CVSS 5.5) vulnerability in media: mtk-jpeg: cancel workqueue on release for supported platforms only. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=2209fdae5c2f615930c9af1379c1cfca199ec5d8 <0fed0fc34ce734b4b8c2f6a467d38bddcb21dda9 || >=0498b27a1542021d90269d58347501d4c3ccd84e <ac0774961a6ea174a71d4ffa39966edafbf7662d || >=26506a30e0e26d612f82a7bf0e395626968a44e6 <973408ceab14555a8548b97c8cc7b54208c3f251 || >=34c519feef3e4fcff1078dc8bdb25fbbbd10303f <4c4b4af4a9f278da096f0dbdb6b59594701d29bf || >=34c519feef3e4fcff1078dc8bdb25fbbbd10303f <b1845a227fda37b2fe5327df3ca0015d7e290235 || e78c39f720679fcf3a2eacd82725ec3ea2648301 || >=6.6.140 <6.6.145 || >=6.12.86 <6.12.96 || >=6.18.27 <6.18.39 || >=7.0.4 <7.1 | 0fed0fc34ce734b4b8c2f6a467d38bddcb21dda9, ac0774961a6ea174a71d4ffa39966edafbf7662d, 973408ceab14555a8548b97c8cc7b54208c3f251, 4c4b4af4a9f278da096f0dbdb6b59594701d29bf, b1845a227fda37b2fe5327df3ca0015d7e290235, 6.6.145, 6.12.96, 6.18.39, 7.1 |
| Linux/Linuxgeneric | 7.1 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtk_jpeg_release function cancels any pending or running work present in the driver workqueue using cancel_work_sync function. Currently, only the multicore based variants use this workqueue and they have the jpeg_worker platform data field initialized with a workqueue callback function. For the others, this field value remain NULL by default. The cancel_work_sync function is unconditionally called in mtk_jpeg_release function, even for the variants that do not use the workqueue. This call generates a WARN_ON print in __flush_work because the workqueue callback function presence check fails in __flush_work function (used by cancel_work_sync). So, to avoid these warnings, call cancel_work_sync only if a workqueue callback is defined in platform data.
Quoted source text, attributed separately from HOL analysis.