A race condition in the MediaTek JPEG driver allows a use‑after‑free on the kernel context structure when the device driver is closed while work is queued. The work queue handler may still run and reference memory that has been freed, enabling an attacker to trigger arbitrary code execution or kernel memory corruption. The vulnerability is a classic use‑after‑free scenario (CWE‑416) that compromises kernel integrity and can lead to full system compromise.

The flaw exists in the Linux kernel’s MediaTek JPEG driver. No specific kernel versions are listed; the issue is present wherever the driver is deployed, typically in boards that include MediaTek integrated media hardware and run a kernel with the mtk_jpeg driver loaded.

The CVSS score is not provided and the EPSS score is unavailable, making the quantitative risk assessment uncertain. The flaw is not listed in the CISA KEV catalog. Exploitation requires a local attacker who has the ability to trigger JPEG encode/decode operations and close the device while work is pending, indicating a local, privileged‑context attack vector rather than a network‑based one. However, because the defect occurs in kernel land, any successful exploitation would provide high‑impact control over the system.