CVE-2026-43151: Linux Kernel Privilege Escalation Flaw

CVE-2026-43151 Overview

CVE-2026-43151 is a Linux kernel vulnerability in the iris media driver. The issue stems from a sanity check that skipped stop_streaming when an instance was in the IRIS_INST_ERROR state. Kernel maintainers reverted commit ad699fa78b59241c9d71a8cafb51525f3dab04d4 after the check produced multiple regressions in the videobuf2 (vb2) subsystem and firmware lifecycle. The revert restores correct buffer return semantics and ensures proper teardown of failed sessions.

Critical Impact
The faulty check left buffers unreturned to vb2 and prevented stop_streaming cleanup after early session failure, leaving firmware in an inconsistent state.

Affected Products

Linux kernel versions containing commit ad699fa78b59241c9d71a8cafb51525f3dab04d4
Systems using the Qualcomm iris video media driver
Distributions consuming affected stable kernel branches prior to the revert

Discovery Timeline

2026-05-06 - CVE-2026-43151 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43151

Vulnerability Analysis

The iris media driver implements a Video4Linux2 (V4L2) interface backed by the videobuf2 (vb2) buffer queue framework. The reverted commit added a sanity check that bypassed the driver's stop_streaming callback when the instance state was IRIS_INST_ERROR. This optimization broke two contracts the vb2 core relies on.

First, vb2 expects every queued buffer to be returned with a completion state when streaming stops. Skipping stop_streaming left buffers owned by the driver, which triggered warnings in the vb2 core because buffer completion was never signaled.

Second, when a session failed early due to an unsupported configuration, the instance transitioned to IRIS_INST_ERROR. Subsequent userspace cleanup calls were silently ignored, preventing the firmware from being notified to release its session resources.

Root Cause

The root cause is incorrect state-based gating of cleanup logic. Treating IRIS_INST_ERROR as a terminal state that needed no teardown ignored the requirement that stop_streaming must always release vb2 buffers and synchronize with the firmware regardless of error state.

Attack Vector

The NVD entry does not enumerate a remote attack vector. The defect is primarily a reliability and resource-management regression triggered by local userspace operations on the iris device when a session enters an error state. See the Kernel Git Commit 370e190, Kernel Git Commit a58b9d1, and Kernel Git Commit bd4f8fa for the corrective patches.

No verified proof-of-concept code is available. The defect manifests through normal V4L2 ioctl sequences (VIDIOC_STREAMON followed by VIDIOC_STREAMOFF) when a configuration error places the instance into IRIS_INST_ERROR.

Detection Methods for CVE-2026-43151

Indicators of Compromise

Kernel warnings originating from the vb2 core referencing buffer completion paths after a streaming session ends
dmesg entries indicating an iris instance entered IRIS_INST_ERROR followed by failed stop_streaming cleanup
Userspace V4L2 applications reporting hangs or resource leaks after replaying unsupported encode or decode configurations

Detection Strategies

Inventory running kernel versions and identify systems where commit ad699fa78b59241c9d71a8cafb51525f3dab04d4 is present without the corresponding revert
Audit kernel logs for vb2 buffer-completion warnings tied to the iris driver subsystem
Correlate firmware reset events on Qualcomm video accelerators with prior session error transitions

Monitoring Recommendations

Forward /var/log/kern.log and dmesg output to a centralized log platform and alert on vb2 warnings tied to the iris module
Track media subsystem stability metrics on devices using the Qualcomm iris codec
Monitor for repeated firmware reload events that indicate a stuck session state

How to Mitigate CVE-2026-43151

Immediate Actions Required

Apply the upstream stable kernel updates that revert commit ad699fa78b59241c9d71a8cafb51525f3dab04d4
Validate that stop_streaming executes correctly after inducing an IRIS_INST_ERROR test condition
Reboot affected systems after patching to clear any inconsistent firmware state

Patch Information

The fix is delivered as a revert through three stable tree commits: Kernel Git Commit 370e190, Kernel Git Commit a58b9d1, and Kernel Git Commit bd4f8fa. Consume these through your distribution's kernel update channel.

Workarounds

Avoid driver configurations that force an iris instance into IRIS_INST_ERROR, such as unsupported codec parameters
Reload the iris kernel module after error conditions to force a clean firmware re-initialization
Restrict access to the iris V4L2 device nodes to trusted users until the patched kernel is deployed

bash

# Verify the running kernel includes the revert
uname -r
git -C /usr/src/linux log --oneline | grep -E "Revert.*iris.*stop streaming"

# Reload the iris module to recover from a stuck state
sudo modprobe -r iris
sudo modprobe iris