CVE-2026-46210 (GCVE-0-2026-46210)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-05 12:30
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: media: iris: fix use-after-free of fmt_src during MBPF check During concurrency testing, multiple instances can run in parallel, and each instance uses its own inst->lock while the core->lock protects the list of active instances. The race happens because these locks cover different scopes, inst->lock protects only the internals of a single instance, while the Macro Blocks Per Frame (MBPF) checker walks the core list under core->lock and reads fields like fmt_src->width and fmt_src->height. At the same time, iris_close() may free fmt_src and fmt_dst under inst->lock while the instance is still present in the core list. This allows a situation where the MBPF checker, still iterating through the core list, reaches an instance whose fmt_src was already freed by another thread and ends up dereferencing a dangling pointer, resulting in a use-after-free. This happens because the MBPF checker assumes that any instance in the core list is fully valid, but the freeing of fmt_src and fmt_dst without removing the instance from the core list is not correct. The correct ordering is to defer freeing fmt_src and fmt_dst until after the instance has been removed from the core list and all teardown under the core lock has completed, ensuring that no dangling pointers are ever exposed during MBPF checks.
References
Impacted products
Vendor Product Version
Linux Linux Version: 5ad964ad5656668399f00c76707f0d063b64a4b1
Version: 5ad964ad5656668399f00c76707f0d063b64a4b1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/iris/iris_vdec.c",
            "drivers/media/platform/qcom/iris/iris_vdec.h",
            "drivers/media/platform/qcom/iris/iris_venc.c",
            "drivers/media/platform/qcom/iris/iris_venc.h",
            "drivers/media/platform/qcom/iris/iris_vidc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "494ffd1712a588e590e6b1e9f876a8c8b24a9180",
              "status": "affected",
              "version": "5ad964ad5656668399f00c76707f0d063b64a4b1",
              "versionType": "git"
            },
            {
              "lessThan": "3d9593ad1a58c5acc3e5fa2a48222bb7632e6812",
              "status": "affected",
              "version": "5ad964ad5656668399f00c76707f0d063b64a4b1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/iris/iris_vdec.c",
            "drivers/media/platform/qcom/iris/iris_vdec.h",
            "drivers/media/platform/qcom/iris/iris_venc.c",
            "drivers/media/platform/qcom/iris/iris_venc.h",
            "drivers/media/platform/qcom/iris/iris_vidc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.9",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: iris: fix use-after-free of fmt_src during MBPF check\n\nDuring concurrency testing, multiple instances can run in parallel, and\neach instance uses its own inst-\u003elock while the core-\u003elock protects the\nlist of active instances. The race happens because these locks cover\ndifferent scopes, inst-\u003elock protects only the internals of a single\ninstance, while the Macro Blocks Per Frame (MBPF) checker walks the\ncore list under core-\u003elock and reads fields like fmt_src-\u003ewidth and\nfmt_src-\u003eheight. At the same time, iris_close() may free fmt_src and\nfmt_dst under inst-\u003elock while the instance is still present in the core\nlist. This allows a situation where the MBPF checker, still iterating\nthrough the core list, reaches an instance whose fmt_src was already\nfreed by another thread and ends up dereferencing a dangling pointer,\nresulting in a use-after-free. This happens because the MBPF checker\nassumes that any instance in the core list is fully valid, but the\nfreeing of fmt_src and fmt_dst without removing the instance from the\ncore list is not correct.\n\nThe correct ordering is to defer freeing fmt_src and fmt_dst until after\nthe instance has been removed from the core list and all teardown under\nthe core lock has completed, ensuring that no dangling pointers are ever\nexposed during MBPF checks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through V4L2 ioctls (REQBUFS/STREAMON/close) on a local `/dev/video*` codec device node; there is no network-facing path to the iris driver.\nAC:L - The attacker controls both sides of the race\u2014closing one instance (freeing fmt_src while still listed) while issuing REQBUFS/STREAMON on another to walk the core list\u2014and the two paths use different locks, so the window is reliably re-triggerable.\nPR:L - Exploitation requires opening the codec device node, which a normal local unprivileged user/app can do (video-group/logind ACL on Linux, mediacodec/app access on Android); no root or special capability is needed.\nUI:N - The attacker performs all device opens, ioctls, and closes itself; no victim action is required.\nS:U - The use-after-free is confined to the kernel\u0027s own memory and security authority; it does not cross into another security scope such as a VM or IOMMU boundary.\nC:H - This is a use-after-free read of a freed slab object (`struct v4l2_format`); a reallocated, attacker-controlled object enables disclosure of kernel memory contents.\nI:H - A UAF on a freed heap object permits heap-spray/reallocation manipulation that can be leveraged into a write/control primitive over the dangling slab object.\nA:H - Dereferencing the dangling `fmt_src` pointer (potentially in an unmapped/reused page) readily causes a kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:31.650Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/494ffd1712a588e590e6b1e9f876a8c8b24a9180"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d9593ad1a58c5acc3e5fa2a48222bb7632e6812"
        }
      ],
      "title": "media: iris: fix use-after-free of fmt_src during MBPF check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46210",
    "datePublished": "2026-05-28T09:40:27.884Z",
    "dateReserved": "2026-05-13T15:03:33.105Z",
    "dateUpdated": "2026-08-05T12:30:31.650Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.