In the Linux kernel, the following vulnerability has been resolved:

media: iris: Fix use-after-free in irisreleaseinternalbuffers()

The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") introduced a regression where sessionreleasebuf() may free the buffer. The caller, irisreleaseinternalbuffers(), continued to access buffer after the call, leading to a potential use-after-free.

Fix this by setting BUFATTRPENDINGRELEASE before calling sessionreleasebuf(), and reverting the flag if the call fails. This ensures no dereference occurs after potential freeing.