Deadlock Vulnerability in UVC Video Device Driver of Linux Kernel

CVE-2026-74437

What is CVE-2026-74437?

A deadlock vulnerability has been identified in the UVC video device driver of the Linux kernel. This issue occurs when the uvc_status_stop function is invoked from the async_ctrl.work context while handling asynchronous controls for UVC cameras. The improper handling leads to a situation where the cancel_work_sync function is unable to complete due to waiting for the uvc_ctrl_status_event_work to finish, causing a deadlock. The solution involves modifying the logic to allow uvc_status_stop to exit early if it is called while already in the work context, preventing further complications and ensuring robust operation of UVC drivers in Linux.

References