{"apiVersion":"1.0","identifier":"CVE-2026-74437","description":"In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work If a UVC camera has an asynchronous control, uvc_status_stop may be called from async_ctrl.work: uvc_ctrl_status_event_work() uvc_ctrl_status_event() uvc_ctrl_clear_handle() uvc_pm_put() uvc_status_put() uvc_status_stop() cancel_work_sync() This will cause a deadlock, since cancel_work_sync will wait for uvc_ctrl_status_event_work to complete before returning. Fix this by returning early from uvc_status_stop if we are currently in the work function. flush_status now remains false until uvc_status_start is called again, ensuring that uvc_ctrl_status_event_work won-t resubmit the URB.","publishedAt":"2026-08-15T06:22:45","lastModifiedAt":"2026-08-17T06:19:39","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74437","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00155,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74437","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74437","en":"https://www.redsauce.net/en/cves/CVE-2026-74437","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74437","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74437","de":"https://www.redsauce.net/de/cves/CVE-2026-74437","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74437","el":"https://www.redsauce.net/el/cves/CVE-2026-74437"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74437"}}