{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.176-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.86-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.4-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  media: amphion: Fix race between m2m job_abort and device_run  Fix kernel panic caused by race condition where v4l2_m2m_ctx_release() frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run with the same context.  Race sequence:   v4l2_m2m_try_run():           v4l2_m2m_ctx_release():     lock/unlock                   v4l2_m2m_cancel_job()                                     job_abort()                                       v4l2_m2m_job_finish()                                   kfree(m2m_ctx)  \u003c- frees ctx     device_run()  \u003c- use-after-free crash at 0x538  Crash trace:   Unable to handle kernel read from unreadable memory at virtual address   0000000000000538   v4l2_m2m_try_run+0x78/0x138   v4l2_m2m_device_run_work+0x14/0x20  The amphion vpu driver does not rely on the m2m framework's device_run callback to perform encode/decode operations.  Fix the race by preventing m2m framework job scheduling entirely: - Add job_ready callback returning 0 (no jobs ready for m2m framework) - Remove job_abort callback to avoid the race condition",
  "id": "DEBIAN-CVE-2026-46058",
  "modified": "2026-09-14T16:47:43.803678726Z",
  "published": "2026-05-27T14:17:25.537Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-46058"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-46058"
  ]
}