CVE-2026-46240
HIGH EPSS 2.5%
Published May 28, 20261mo ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
Published May 28, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago
Description
In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix use-after-free in iris_release_internal_buffers() The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") introduced a regression where session_release_buf() may free the buffer. The caller, iris_release_internal_buffers(), continued to access `buffer` after the call, leading to a potential use-after-free. Fix this by setting BUF_ATTR_PENDING_RELEASE before calling session_release_buf(), and reverting the flag if the call fails. This ensures no dereference occurs after potential freeing.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
2.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-416 Use After Free Memory Safety
Affected Products 4
References 3
- git.kernel.org https://git.kernel.org/stable/c/18c64439f249859b6140f7bf8bcf95c8ed841f28
- git.kernel.org https://git.kernel.org/stable/c/dd24998a4a4016fb9921916024399bd80f0d45c6
- git.kernel.org https://git.kernel.org/stable/c/f27cfdcfc916bb59297825805f4c3499f89f9e76
Remediation
- git.kernel.org https://git.kernel.org/stable/c/18c64439f249859b6140f7bf8bcf95c8ed841f28
- git.kernel.org https://git.kernel.org/stable/c/dd24998a4a4016fb9921916024399bd80f0d45c6
- git.kernel.org https://git.kernel.org/stable/c/f27cfdcfc916bb59297825805f4c3499f89f9e76