A race condition exists in the MediaTek JPEG driver of the Linux kernel where the mtk_jpeg_release() function frees its context structure before canceling any pending work; this results in a use‑after‑free that corrupts kernel memory. The primary impact is local kernel memory corruption that could enable a local attacker to gain elevated privileges or crash the system, reflecting CWE-825 weaknesses.

The vulnerability resides in the kernel's media subsystem for MediaTek devices, specifically in the mtk_jpeg component. It affects all Linux kernel releases that include this driver and have not yet incorporated the commit that performs cancel_work_sync() before freeing ctx. Vendors listed by the CNA are Linux:Linux, meaning any Linux distribution whose kernel contains this driver may be vulnerable. Exact version ranges are not disclosed, but any system that has not applied the patch referenced in the provided commit logs remains affected.

The CVSS score of 7.8 denotes high severity, yet the EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. Based on the description, the attack vector requires local access and the ability to open the JPEG device; an attacker would need to initiate an encode or decode operation, then close the device while work is pending. Because the work runs in the kernel, the threat is limited to privileged or local users that have access to the device file. If successful, the attacker could trigger a kernel panic or achieve privilege escalation, but remote code execution is not implied by the current data.