media: iris: fix use-after-free of fmt_src during MBPF check
In the Linux kernel, the following vulnerability has been resolved: media: iris: fix use-after-free of fmt_src during MBPF check During concurrency testing, multiple instances can run in parallel, and each instance uses its own inst->lock while the core->lock protects the list of active instances. The race happens because these locks cover different scopes, inst->lock protects only the internals of a single instance, while the Macro Blocks Per Frame (MBPF) checker walks the core list under core->lock and reads fields like fmt_src->width and fmt_src->height. At the same time, iris_close() may free fmt_src and fmt_dst under inst->lock while the instance is still present in the core list. This allows a situation where the MBPF checker, still iterating through the core list, reaches an instance whose fmt_src was already freed by another thread and ends up dereferencing a dangling pointer, resulting in a use-after-free. This happens because the MBPF checker assumes that any instance in the core list is fully valid, but the freeing of fmt_src and fmt_dst without removing the instance from the core list is not correct. The correct ordering is to defer freeing fmt_src and fmt_dst until after the instance has been removed from the core list and all teardown under the core lock has completed, ensuring that no dangling pointers are ever exposed during MBPF checks.
CVE-2026-46210
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-46210
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5ad964ad5656668399f00c76707f0d063b64a4b1",
"lessThan": "96889fcdb0988108a19a29b0467717a503651a73",
"versionType": "git"
},
{
"status": "affected",
"version": "5ad964ad5656668399f00c76707f0d063b64a4b1",
"lessThan": "494ffd1712a588e590e6b1e9f876a8c8b24a9180",
"versionType": "git"
},
{
"status": "affected",
"version": "5ad964ad5656668399f00c76707f0d063b64a4b1",
"lessThan": "3d9593ad1a58c5acc3e5fa2a48222bb7632e6812",
"versionType": "git"
}
],
"programFiles": [
"drivers/media/platform/qcom/iris/iris_vdec.c",
"drivers/media/platform/qcom/iris/iris_vdec.h",
"drivers/media/platform/qcom/iris/iris_venc.c",
"drivers/media/platform/qcom/iris/iris_venc.h",
"drivers/media/platform/qcom/iris/iris_vidc.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/media/platform/qcom/iris/iris_vdec.c",
"drivers/media/platform/qcom/iris/iris_vdec.h",
"drivers/media/platform/qcom/iris/iris_venc.c",
"drivers/media/platform/qcom/iris/iris_venc.h",
"drivers/media/platform/qcom/iris/iris_vidc.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-46210
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #28605 · Revision 1
- Added to Heist Feed
- Publisher date