In the Linux kernel, the following vulnerability has been resolved:
media: mediatek: vcodec: Fix oops when HEVC init fails
The stateless HEVC decoder saves the instance pointer in the context regardless if the initialization worked or not. This caused a use after free, when the pointer is freed in case of a failure in the deinit function. Only store the instance pointer when the initialization was successful, to solve this issue.
Hardware name: Acer Tomato (rev3 - 4) board (DT) pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] lr : vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] sp : ffff80008750bc20 x29: ffff80008750bc20 x28: ffff1299f6d70000 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: ffff80008750bc98 x22: 000000000000a003 x21: ffffd45c4cfae000 x20: 0000000000000010 x19: ffff1299fd668310 x18: 000000000000001a x17: 000000040044ffff x16: ffffd45cb15dc648 x15: 0000000000000000 x14: ffff1299c08da1c0 x13: ffffd45cb1f87a10 x12: ffffd45cb2f5fe80 x11: 0000000000000001 x10: 0000000000001b30 x9 : ffffd45c4d12b488 x8 : 1fffe25339380d81 x7 : 0000000000000001 x6 : ffff1299c9c06c00 x5 : 0000000000000132 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000010 x1 : ffff80008750bc98 x0 : 0000000000000000 Call trace: vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] vpu_dec_deinit+0x1c/0x30 [mtk_vcodec_dec] vdec_hevc_slice_deinit+0x30/0x98 [mtk_vcodec_dec] vdec_if_deinit+0x38/0x68 [mtk_vcodec_dec] mtk_vcodec_dec_release+0x20/0x40 [mtk_vcodec_dec] fops_vcodec_release+0x64/0x118 [mtk_vcodec_dec] v4l2_release+0x7c/0x100 __fput+0x80/0x2d8 __fput_sync+0x58/0x70 __arm64_sys_close+0x40/0x90 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x38/0xd8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x1a8/0x1b0 Code: d503201f f9401660 b900127f b900227f (f9400400)
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Suse | — | Upgrade kernel-devel-azureUpgrade kernel-64kbUpgrade dtb-mediatekUpgrade gfs2-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-default-livepatchUpgrade kernel-64kb-optionalUpgrade kernel-debug-develUpgrade dtb-alteraUpgrade kernel-default-extraUpgrade kernel-default-develUpgrade kernel-debug-livepatch-develUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmallUpgrade kernel-azure-vdsoUpgrade kernel-devel-rtUpgrade kernel-azure-optionalUpgrade kernel-obs-qaUpgrade dtb-hisiliconUpgrade kernel-64kb-livepatch-develUpgrade kernel-source-azureUpgrade kernel-macrosUpgrade kernel-symsUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-rtUpgrade dtb-exynosUpgrade kernel-syms-azureUpgrade dtb-apmUpgrade cluster-md-kmp-defaultUpgrade dtb-xilinxUpgrade reiserfs-kmp-64kbUpgrade dtb-lgUpgrade kernel-azure-extraUpgrade kernel-64kb-develUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-rtUpgrade kernel-debugUpgrade kernel-develUpgrade kernel-azure-livepatch-develUpgrade kernel-docs-htmlUpgrade dtb-amazonUpgrade dtb-broadcomUpgrade dtb-marvellUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-freescaleUpgrade dtb-amdUpgrade kernel-rt_debugUpgrade kernel-rt_debug-vdsoUpgrade kselftests-kmp-64kbUpgrade kernel-default-optionalUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-azureUpgrade kernel-syms-rtUpgrade dtb-appleUpgrade kernel-default-baseUpgrade kernel-source-vanillaUpgrade dtb-sprdUpgrade dtb-socionextUpgrade kernel-rt_debug-develUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade kernel-source-rtUpgrade dtb-caviumUpgrade dlm-kmp-defaultUpgrade kernel-rt-extraUpgrade gfs2-kmp-defaultUpgrade kernel-azure-develUpgrade gfs2-kmp-azureUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade kselftests-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-rtUpgrade dtb-renesasUpgrade cluster-md-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-defaultUpgrade dlm-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-azureUpgrade kernel-rtUpgrade dtb-armUpgrade ocfs2-kmp-defaultUpgrade dtb-qcomUpgrade kernel-rt-vdsoUpgrade kernel-obs-buildUpgrade dtb-nvidiaUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-rtUpgrade dtb-rockchipUpgrade kernel-rt-develUpgrade kernel-docsUpgrade kernel-64kb-extra | Jun 24, 2024 | May 19, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-kvmUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-azure-fdeUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-oem-24.04aUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1011-awsUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibmUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-raspiUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gkeUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-intelUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-awsUpgrade linux-image-azure | Jul 12, 2024 | May 19, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub