PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46240 Linux CVE debrief

A use-after-free vulnerability in the Linux kernel's Qualcomm IRIS video driver (media: iris) was introduced by a regression in commit 1dabf00ee206. The flaw occurs in iris_release_internal_buffers() where session_release_buf() may free a buffer, but the caller continues to access the buffer pointer afterward. The fix sets BUF_ATTR_PENDING_RELEASE before calling session_release_buf() and reverts the flag on failure, preventing dereference after potential freeing. This affects the IRIS video codec driver used for video encoding/decoding on Qualcomm platforms. The vulnerability was resolved in stable kernel branches with commits 18c64439f249, dd24998a4a40, and f27cfdcfc916.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-30
Advisory published
2026-05-28
Advisory updated
2026-05-30

Who should care

Organizations running Linux systems with Qualcomm Snapdragon platforms utilizing video encoding/decoding capabilities; embedded/IoT device manufacturers using Qualcomm IRIS video codecs; kernel maintainers and distribution security teams packaging stable kernel updates

Technical summary

The vulnerability exists in the Qualcomm IRIS (Image Signal Processor) video driver within the Linux kernel media subsystem. The regression was introduced when internal buffer destruction was moved to occur after firmware release. The function iris_release_internal_buffers() calls session_release_buf(), which may free the buffer structure. The original code continued to access the buffer pointer after this call, creating a use-after-free condition. The fix implements a state flag pattern: BUF_ATTR_PENDING_RELEASE is set before the release call, and reverted only if the call fails. This ensures no pointer dereference occurs after potential memory freeing. The IRIS driver handles video codec operations on Qualcomm platforms; exploitation would require local access to trigger the buffer release code path.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits to systems using the Qualcomm IRIS video driver
  • Monitor vendor security advisories for distribution-specific kernel packages
  • Review systems with video encoding/decoding workloads on Qualcomm platforms for stability issues
  • Validate kernel version against fixed commits in stable branches

Evidence notes

The CVE description explicitly identifies this as a regression from commit 1dabf00ee206 (media: iris: gen1: Destroy internal buffers after FW releases). The fix pattern involves setting BUF_ATTR_PENDING_RELEASE before session_release_buf() to prevent use-after-free. Three stable kernel commits are referenced as fixes.

Official resources

2026-05-28