PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46210 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's Qualcomm IRIS video driver (drivers/media/platform/qcom/iris). The flaw occurs due to a race condition between the Macro Blocks Per Frame (MBPF) checker and instance teardown. The MBPF checker iterates through active instances under core->lock to validate format dimensions, while iris_close() frees fmt_src and fmt_dst under inst->lock without first removing the instance from the core list. This allows a concurrent MBPF check to dereference freed memory when accessing fmt_src->width and fmt_src->height. The vulnerability was resolved by reordering operations to defer freeing format structures until after the instance is removed from the core list and all core-level teardown completes.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-10
Advisory published
2026-05-28
Advisory updated
2026-06-10

Who should care

Organizations running Linux systems with Qualcomm IRIS video acceleration hardware, particularly those with multi-threaded video encoding/decoding workloads or containerized environments where multiple video instances may operate concurrently.

Technical summary

The vulnerability is a use-after-free (CWE-416) in the Qualcomm IRIS video driver, triggered by a race condition between the MBPF (Macro Blocks Per Frame) validation logic and instance closure. The MBPF checker holds core->lock and traverses the instance list, reading fmt_src dimensions. Concurrently, iris_close() acquires inst->lock and frees fmt_src/fmt_dst while the instance remains in the core list. The fix restructures teardown to: (1) acquire core->lock, (2) remove instance from core list, (3) release core->lock, (4) then free format structures under inst->lock. This ensures no concurrent MBPF check can access freed memory.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from the stable kernel git repository when available for your distribution
  • Verify kernel version includes fixes for the IRIS media driver race condition
  • Review systems utilizing Qualcomm IRIS video acceleration for kernel update scheduling
  • Monitor vendor security advisories for backported fixes if running long-term support kernel versions

Evidence notes

The vulnerability description is sourced from the official CVE record published 2026-05-28. The fix involves two kernel commits addressing the race condition in the IRIS media driver. The flaw affects concurrency scenarios where multiple video encoder/decoder instances operate simultaneously.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46210 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46210

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46210 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46210

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3d9593ad1a58c5acc3e5fa2a48222bb7632e6812

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/494ffd1712a588e590e6b1e9f876a8c8b24a9180

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.