Executive brief
A vulnerability in the Linux kernel's video streaming driver for Qualcomm Iris hardware could allow a local user to cause a system instability or denial of service. The issue occurs when the system fails to properly clean up video buffers and firmware states during an error, potentially leading to resource exhaustion or inconsistent device behavior. This affects systems using specific Qualcomm video hardware and requires local access to exploit.
Technical details
The vulnerability stems from an incorrect sanity check in the 'iris' media driver that skipped the 'stop_streaming' operation if the driver instance was already in an error state (IRIS_INST_ERROR). This logic error resulted in two primary regressions: video buffers were not returned to the vb2 core, and the firmware was not properly notified of session termination. A local attacker could potentially leverage this to cause a kernel warning or leave the video hardware in an unusable state. The fix involves reverting the problematic check to ensure proper buffer completion and firmware cleanup regardless of the instance state.
Affected products
- Linux Linux Kernel 6.18.3 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2025-12-29: patched: Initial patch authored
- 2026-05-06: disclosed: CVE published