CVE-2026-46210media: iris: fix use-after-free of fmt_src during MBPF check
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: iris: fix use-after-free of fmt_src during MBPF check During concurrency testing, multiple instances can run in parallel, and each instance uses its own inst->lock while the core->lock protects the list of active instances. The race happens because these locks cover different scopes, inst->lock protects only the internals of a single instance, while the Macro Blocks Per Frame (MBPF) checker walks the core list under core->lock and reads fields like fmt_src->width and fmt_src->height. At the same time, iris_close() may free fmt_src and fmt_dst under inst->lock while the instance is still present in the core list. This allows a situation where the MBPF checker, still iterating through the core list, reaches an instance whose fmt_src was already freed by another thread and ends up dereferencing a dangling pointer, resulting in a use-after-free. This happens because the MBPF checker assumes that any instance in the core list is fully valid, but the freeing of fmt_src and fmt_dst without removing the instance from the core list is not correct. The correct ordering is to defer freeing fmt_src and fmt_dst until after the instance has been removed from the core list and all teardown under the core lock has completed, ensuring that no dangling pointers are ever exposed during MBPF checks.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5ad964ad5656668399f00c76707f0d063b64a4b1 before 96889fcdb0988108a19a29b0467717a503651a73; from 5ad964ad5656668399f00c76707f0d063b64a4b1 before 494ffd1712a588e590e6b1e9f876a8c8b24a9180; 5ad964ad5656668399f00c76707f0d063b64a4b1 builds before 3d9593ad1a58c5acc3e5fa2a48222bb7632e6812 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.18 before 7.0.9; 7.1; 7.1 | NVD |
References
- https://git.kernel.org/stable/c/96889fcdb0988108a19a29b0467717a503651a73
- https://git.kernel.org/stable/c/494ffd1712a588e590e6b1e9f876a8c8b24a9180patch
- https://git.kernel.org/stable/c/3d9593ad1a58c5acc3e5fa2a48222bb7632e6812patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.