CVE-2023-52491

What it actually does

Use-after-free in the mtk-jpeg kernel driver caused by an error path in mtk_jpeg_dec_device_run that schedules a timeout worker after v4l2_m2m_job_finish has already released the m2m_dev context; subsequent access in mtk_jpeg_job_timeout_work dereferences the freed structure.

Why it matters to the business

Systems using the MediaTek JPEG decoder on affected kernels can experience kernel crashes, memory corruption, or local privilege escalation, disrupting video/media workloads and requiring urgent patching of production Linux hosts.

How an attack unfolds

An attacker with local access triggers an error in mtk_jpeg_set_dec_dst while the decoder worker runs, then forces module unload or file-descriptor close to free the m2m context; the still-scheduled timeout worker later dereferences the freed object, enabling memory corruption or denial of service.

How to fix it

Upgrade the linux package on Debian 11 to version 5.10.178-1 or later; rebuild and reboot with the fixed kernel. If hardware is not present, blacklist the mtk_jpeg module as a temporary mitigation.

How to confirm the fix worked

Confirm the running kernel version is at least 5.10.178-1; inspect /proc/version or uname output and verify the mtk-jpeg driver source no longer schedules the timeout worker after job finish on error paths.

Typical attack path

1. Obtain local shell on a system exposing the mtk-jpeg device
2. Open the decoder device and issue a decode request that fails inside mtk_jpeg_set_dec_dst
3. Concurrently trigger mtk_jpeg_remove or mtk_jpeg_release to free the m2m_dev structure
4. Allow the scheduled mtk_jpeg_job_timeout_work to execute and dereference the freed context

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops traces, slab-use-after-free warnings, or stack traces containing mtk_jpeg_job_timeout_work, v4l2_m2m_get_curr_priv, or mtk_jpeg_dec_device_run around the time of module unload or device close events.

What your security team should do

• Immediately schedule kernel upgrades to 5.10.178-1 on all Debian 11 systems that may load mtk_jpeg
• Audit for presence of MediaTek JPEG hardware or the mtk_jpeg.ko module and prioritize those hosts
• Monitor kernel logs for oops or use-after-free warnings involving mtk_jpeg or v4l2_m2m until patches are applied