CVE-2026-46240: media: iris: Fix use-after-free in iris_release_internal_buffers()
In the Linux kernel, the following vulnerability has been resolved:
media: iris: Fix use-after-free in irisreleaseinternalbuffers()
The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") introduced a regression where sessionreleasebuf() may free the buffer. The caller, irisreleaseinternalbuffers(), continued to access buffer after the call, leading to a potential use-after-free.
Fix this by setting BUFATTRPENDINGRELEASE before calling sessionreleasebuf(), and reverting the flag if the call fails. This ensures no dereference occurs after potential freeing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the regression by setting BUF_ATTR_PENDING_RELEASE before calling session_release_buf(), so iris_release_internal_buffers() does not dereference `buffer` after session_release_buf() may free it. Also revert the flag if the call fails.
Linux kernel (media: iris) BUF_ATTR_PENDING_RELEASE = set before calling iris_release_internal_buffers()/session_release_buf()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46240?
The severity of CVE-2026-46240 is high with a score of 7.8.
What is the nature of CVE-2026-46240?
CVE-2026-46240 involves a use-after-free vulnerability in the Linux kernel related to media: iris.
How do I fix CVE-2026-46240?
To fix CVE-2026-46240, ensure that you apply the latest patches from the Linux kernel that address this vulnerability.
What systems are affected by CVE-2026-46240?
CVE-2026-46240 affects systems running the Linux Foundation Linux kernel, specifically those utilizing media/iris.
What can happen if CVE-2026-46240 is exploited?
Exploitation of CVE-2026-46240 can lead to arbitrary code execution, data corruption, or system crashes.