Executive brief
A vulnerability in the Linux kernel's video driver for Qualcomm Iris hardware could allow a local user to crash the system. The issue occurs when the system attempts to stop a video stream after a session error has already cleared necessary memory. This results in a system instability or a complete crash, impacting the availability of the device.
Technical details
A null pointer dereference vulnerability exists in the Linux kernel's iris media driver (gen2). In the `iris_kill_session` function, the instance state is set to `IRIS_INST_ERROR` and `session_close` is executed, which frees `inst_hfi_gen2->packet` using `kfree`. If `stop_streaming` is subsequently called, the driver attempts to access this freed memory, leading to a kernel crash. The fix introduces a NULL check for `inst_hfi_gen2->packet` within `iris_hfi_gen2_session_stop` before attempting to send the STOP packet to the firmware. This is a local vulnerability requiring low privileges to trigger.
Affected products
- Linux Linux Kernel 6.15 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-01-20: patched: Initial patch commit in mainline kernel