Executive brief
A vulnerability was identified in the Linux kernel's 'iris' video driver, which is used for hardware-accelerated video processing on certain platforms. A race condition could allow a local user or malicious application to trigger a system crash or potentially execute unauthorized code by exploiting how the system handles concurrent video sessions. This could lead to a denial of service or a compromise of system integrity.
Technical details
A use-after-free vulnerability exists in the Linux kernel iris video driver (drivers/media/platform/qcom/iris). The root cause is a race condition between the Macro Blocks Per Frame (MBPF) checker and the iris_close() function. While the MBPF checker iterates through the core instance list under core->lock, iris_close() may free fmt_src and fmt_dst structures under a different lock (inst->lock) before the instance is removed from the core list. This allows the MBPF checker to dereference a dangling pointer when reading width and height fields. The fix involves deferring the freeing of these structures until after the instance has been removed from the core list and all teardown under the core lock is complete.
Affected products
- Linux Linux Kernel iris driver
Timeline
- 2026-03-05: other: Patch authored
- 2026-05-28: disclosed: CVE published