PT-2026-44363 · Linux · Linux

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-46240

Mitre

In the Linux kernel, the following vulnerability has been resolved:

media: iris: Fix use-after-free in iris release internal buffers()

The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") introduced a regression where session release buf() may free the buffer. The caller, iris release internal buffers(), continued to access buffer after the call, leading to a potential use-after-free.

Fix this by setting BUF ATTR PENDING RELEASE before calling session release buf(), and reverting the flag if the call fails. This ensures no dereference occurs after potential freeing.

Related Identifiers

CVE-2026-46240

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-46240 · Security Note
• https://git.kernel.org/stable/c/dd24998a4a4016fb9921916024399bd80f0d45c6 · Note
• https://git.kernel.org/stable/c/f27cfdcfc916bb59297825805f4c3499f89f9e76 · Note
• https://git.kernel.org/stable/c/18c64439f249859b6140f7bf8bcf95c8ed841f28 · Note