CVE-2026-74437

A flaw was found in the Linux kernel's uvcvideo module, which manages USB Video Class (UVC) devices. When a UVC camera with asynchronous control is in use, a specific sequence of operations can lead to a deadlock within the kernel. This vulnerability could allow a local attacker to cause a system-wide denial of service.

A MODERATE severity flaw was found in the Linux kernel's uvcvideo driver, which manages USB Video Class (UVC) devices. When a UVC camera with asynchronous controls is in use, handling an asynchronous control status event can result in uvc_status_stop() being called from within the asynchronous control work item itself; the cancel_work_sync() call inside uvc_status_stop() then waits for that same work item to complete, producing a deadlock in the kernel that causes a system-wide denial of service. Exploiting this flaw requires local access to a system with a connected UVC camera that supports asynchronous controls. Within Red Hat Enterprise Linux, the kernel and kernel-rt in the rhel-9.9 stream and the kernel in the rhel-10.2.z and rhel-10.3 streams are affected; the fix for these streams is currently deferred, so the residual risk of a local denial of service remains until the fix is delivered. Other Red Hat Enterprise Linux streams and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.