PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46240 Linux CVE debrief

A use-after-free vulnerability in the Linux kernel's Qualcomm IRIS video driver (media: iris) was introduced by a regression in commit 1dabf00ee206. The flaw occurs in iris_release_internal_buffers() where session_release_buf() may free a buffer, but the caller continues to access the buffer pointer afterward. The fix sets BUF_ATTR_PENDING_RELEASE before calling session_release_buf() and reverts the flag on failure, preventing dereference after potential freeing. This affects the IRIS video codec driver used for video encoding/decoding on Qualcomm platforms. The vulnerability was resolved in stable kernel branches with commits 18c64439f249, dd24998a4a40, and f27cfdcfc916.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-10
Advisory published
2026-05-28
Advisory updated
2026-06-10

Who should care

Organizations running Linux systems with Qualcomm Snapdragon platforms utilizing video encoding/decoding capabilities; embedded/IoT device manufacturers using Qualcomm IRIS video codecs; kernel maintainers and distribution security teams packaging stable kernel updates

Technical summary

The vulnerability exists in the Qualcomm IRIS (Image Signal Processor) video driver within the Linux kernel media subsystem. The regression was introduced when internal buffer destruction was moved to occur after firmware release. The function iris_release_internal_buffers() calls session_release_buf(), which may free the buffer structure. The original code continued to access the buffer pointer after this call, creating a use-after-free condition. The fix implements a state flag pattern: BUF_ATTR_PENDING_RELEASE is set before the release call, and reverted only if the call fails. This ensures no pointer dereference occurs after potential memory freeing. The IRIS driver handles video codec operations on Qualcomm platforms; exploitation would require local access to trigger the buffer release code path.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits to systems using the Qualcomm IRIS video driver
  • Monitor vendor security advisories for distribution-specific kernel packages
  • Review systems with video encoding/decoding workloads on Qualcomm platforms for stability issues
  • Validate kernel version against fixed commits in stable branches

Evidence notes

The CVE description explicitly identifies this as a regression from commit 1dabf00ee206 (media: iris: gen1: Destroy internal buffers after FW releases). The fix pattern involves setting BUF_ATTR_PENDING_RELEASE before session_release_buf() to prevent use-after-free. Three stable kernel commits are referenced as fixes.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46240 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46240

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46240 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46240

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/18c64439f249859b6140f7bf8bcf95c8ed841f28

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/dd24998a4a4016fb9921916024399bd80f0d45c6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f27cfdcfc916bb59297825805f4c3499f89f9e76

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.