Executive brief
A vulnerability was identified in the Linux kernel's 'iris' media driver, which is used for video processing on certain hardware platforms. A flaw in how the driver manages internal memory buffers could allow the system to attempt to use memory after it has already been released. This type of error typically leads to system instability, crashes, or potential unauthorized access to sensitive data by local users.
Technical details
A use-after-free vulnerability exists in the Linux kernel iris media driver within the iris_release_internal_buffers() function. The issue was introduced by a regression where session_release_buf() could free a buffer while the caller continued to access it. An attacker with local access could potentially exploit this race condition or improper state management to cause a kernel panic or execute arbitrary code. The fix involves correctly setting the BUF_ATTR_PENDING_RELEASE flag before the release call and reverting it only if the call fails, ensuring no further dereferences occur after the memory is potentially freed.
Affected products
- Linux Linux Kernel Affected by commit 1dabf00ee206; fixed in f27cfdcfc916bb59297825805f4c3499f89f9e76 and related stable branches.
Timeline
- 2026-02-16: other: Vulnerability fix authored
- 2026-05-28: disclosed: CVE published