Junglewise Threat Intelligence

CVE-2026-43217: Linux Kernel iris driver null pointer dereference in session stop

CVE-2026-43217 · Severity: medium · CVSS 5.5 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's video driver for Qualcomm Iris hardware could allow a local user to crash the system. The issue occurs when the system attempts to stop a video stream after a session error has already cleared necessary memory. This results in a system instability or a complete crash, impacting the availability of the device.

Technical details

A null pointer dereference vulnerability exists in the Linux kernel's iris media driver (gen2). In the `iris_kill_session` function, the instance state is set to `IRIS_INST_ERROR` and `session_close` is executed, which frees `inst_hfi_gen2->packet` using `kfree`. If `stop_streaming` is subsequently called, the driver attempts to access this freed memory, leading to a kernel crash. The fix introduces a NULL check for `inst_hfi_gen2->packet` within `iris_hfi_gen2_session_stop` before attempting to send the STOP packet to the firmware. This is a local vulnerability requiring low privileges to trigger.

Affected products

  • Linux Linux Kernel 6.15 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-05-06: disclosed
  • 2026-05-06: advisory
  • 2026-01-20: patched: Initial patch commit in mainline kernel

References

Related threats