vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-46240

media: iris: Fix use-after-free in iris_release_internal_buffers()

HIGH
7.8
CVSS Score
Published: May 28, 2026 at 09:41 AM UTC
Updated: August 5, 2026 at 01:24 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix use-after-free in iris_release_internal_buffers() The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") introduced a regression where session_release_buf() may free the buffer. The caller, iris_release_internal_buffers(), continued to access `buffer` after the call, leading to a potential use-after-free. Fix this by setting BUF_ATTR_PENDING_RELEASE before calling session_release_buf(), and reverting the flag if the call fails. This ensures no dereference occurs after potential freeing.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
v ≥ 6.19.66.18.16 ≤ v < 6.18.326.19.6 ≤ v < 6.206.19.6 ≤ v < 7.0.97.0 ≤ v < 7.0.97.0 ≤ v < 7.11dabf00ee206eceb0f08a1fe5d1ce635f90643386.18.166.19.67.1 rc17.1 rc27cde76db8883ec8a3d1456068079ecadbfb15ca5d4457f23ac0130240053a34be663f0fade3bb371
Vendor states this is fixed in 18c64439f249859b6140f7bf8bcf95c8ed841f28 (fixed)
Vendor states this is fixed in dd24998a4a4016fb9921916024399bd80f0d45c6 (fixed)
Vendor states this is fixed in f27cfdcfc916bb59297825805f4c3499f89f9e76 (fixed)
Vendor states this is fixed in 6.18.32 (unaffected)
Affected range stops below 6.20, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 7.0 (unaffected)
Vendor states this is fixed in 7.0.9 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

References (3)

Patch
Source: cverecord
https://git.kernel.org/stable/c/dd24998a4a4016fb9921916024399bd80f0d45c6
Patch
Source: cverecord
https://git.kernel.org/stable/c/18c64439f249859b6140f7bf8bcf95c8ed841f28
Patch
Source: cverecord
https://git.kernel.org/stable/c/f27cfdcfc916bb59297825805f4c3499f89f9e76

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusANALYZED
CWE
CWE-416

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card