CVE-2026-46210: Linux Kernel iris Driver Use-After-Free Privilege Escalation

Technical summary

CVE-2026-46210 is a use-after-free in the Linux kernel iris driver (CWE-416) arising from inadequate synchronization between instance teardown and global state validation. Specifically, the Macro Blocks Per Frame (MBPF) checker iterates over the core->instances list under core->lock protection, accessing fields like fmt_src->width and fmt_src->height. However, iris_close() frees fmt_src and fmt_dst under the instance-level inst->lock before removing the instance from the core list. This creates a race condition where the MBPF checker can dereference freed format structures. The root cause is a lock scope mismatch: inst->lock protects only single-instance internals, while core->lock protects the shared instance list, but the freeing of fmt_src/fmt_dst occurs in the wrong order relative to list removal. The fix requires deferring format structure deallocation until after core list removal and all core-lock-protected teardown completes.

Business impact

This vulnerability allows a local, unprivileged user to crash the kernel or potentially execute code with kernel privileges through malicious parallel media operations. Organizations running the affected kernel versions on systems that permit local user access face heightened risk of denial of service and potential privilege escalation. Media server applications, containerized environments, and multi-tenant systems are particularly exposed. The impact scope is limited to local threat actors but severity is significant given the kernel-level execution context and the ability to trigger the race condition through standard media encoding/decoding APIs.

Affected systems

The Linux kernel is affected. The vulnerability exists in the iris media driver component and is present in kernel versions prior to the fix merge. Systems with CONFIG_VIDEO_IRIS enabled or with the iris driver compiled are impacted. This includes edge cases like embedded Linux systems running media transcoding, containerized environments with media processing workloads, and any kernel with the iris driver loaded.

Exploitability

Exploitability is moderate but reliable under the right conditions. An attacker requires local system access and must trigger multiple concurrent media encoding or decoding sessions to reliably hit the race condition window. The vulnerability does not require elevated privileges to initiate, though triggering the crash reliably may benefit from timing or workload tuning. The kernel-level impact (denial of service, potential code execution) is severe, but the local-only attack surface and timing sensitivity limit overall exploitation likelihood in typical deployments.

Remediation

Apply the upstream Linux kernel patch that reorders the teardown sequence to defer freeing fmt_src and fmt_dst until after the instance has been removed from the core->instances list and all core-lock-protected operations have completed. Verify the patch against the relevant Linux kernel mailing list or stable kernel release notes. Organizations should prioritize kernel updates for systems with local user access or untrusted media processing workloads.

Patch guidance

Monitor the Linux kernel stable release branches (longterm and mainstream) for availability of patches addressing this CVE. Check your kernel version via `uname -r` and cross-reference against the vendor advisory and kernel.org to identify the minimum patched version for your branch. The fix involves reordering instance teardown in iris_close() to ensure core list removal occurs before format structure deallocation. Test kernel updates in a non-production environment before deployment, especially if your workload involves concurrent media operations.

Detection guidance

Monitor system logs for iris driver-related kernel oops, segmentation faults, or use-after-free messages, particularly in environments running parallel media encoding or decoding workloads. Runtime detection is challenging without custom kernel instrumentation; focus on monitoring for unusual kernel crashes correlated with media processing. Memory sanitizers or kernel address sanitizers (KASAN) will reliably catch this flaw in test environments. Restrict local user access on systems where media processing occurs if kernel patching is delayed.

Why prioritize this

CVE-2026-46210 merits high-priority patching due to its CVSS 7.8 (HIGH) score, kernel-level impact, and the inherent difficulty users face in avoiding concurrent media operations in multi-tenant or busy media server environments. Although the attack surface is local-only, the reliability of triggering the race condition through normal workload patterns makes it a realistic threat in affected deployments.

Risk score, explained

The CVSS v3.1 score of 7.8 reflects the high severity of kernel-level code execution or denial of service impact (Confidentiality: High, Integrity: High, Availability: High), moderated by the requirement for local access (AV:L) and low privilege (PR:L). The accessibility (AC:L, UI:N) indicates the vulnerability is straightforward to trigger through standard media operations once local access is obtained, justifying the HIGH severity classification.

Frequently asked questions