CVE-2026-74437

In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Fix deadlock if uvcstatusstop is called from async_ctrl.work

If a UVC camera has an asynchronous control, uvcstatusstop may be called from async_ctrl.work:

uvcctrlstatuseventwork() uvcctrlstatusevent() uvcctrlclearhandle() uvcpmput() uvcstatusput() uvcstatusstop() cancelworksync()

This will cause a deadlock, since cancelworksync will wait for uvcctrlstatuseventwork to complete before returning.

Fix this by returning early from uvcstatusstop if we are currently in the work function. flushstatus now remains false until uvcstatusstart is called again, ensuring that uvcctrlstatusevent_work won't resubmit the URB.