CVE-2026-46210
Use-After-Free in Linux Kernel Iris Driver
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can lead to a use-after-free condition in the Linux kernel's media iris driver during concurrency operations. Specifically, it allows a situation where a thread may dereference a dangling pointer because an instance's resources (fmt_src and fmt_dst) are freed while still being referenced by another thread. This can cause undefined behavior such as crashes, memory corruption, or potential escalation of privileges depending on how the kernel handles the invalid memory access.
Can you explain this vulnerability to me?
This vulnerability is a use-after-free issue in the Linux kernel's media iris component related to the Macro Blocks Per Frame (MBPF) checker.
During concurrent operations, multiple instances run in parallel with different locks protecting different scopes. The core lock protects the list of active instances, while each instance has its own lock protecting its internals.
The problem arises because the MBPF checker iterates over the core list under the core lock and reads fields like fmt_src->width and fmt_src->height. Meanwhile, another thread may free fmt_src and fmt_dst under the instance lock while the instance is still present in the core list.
This leads to the MBPF checker dereferencing a dangling pointer, causing a use-after-free error, because it assumes all instances in the core list are fully valid.
The fix involves deferring the freeing of fmt_src and fmt_dst until after the instance has been removed from the core list and all teardown under the core lock is complete, preventing exposure of dangling pointers during MBPF checks.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by ensuring that the freeing of fmt_src and fmt_dst is deferred until after the instance has been removed from the core list and all teardown under the core lock has completed. Immediate mitigation would involve updating the Linux kernel to a version where this fix is applied.