CVE-2026-46210: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46210 Overview

CVE-2026-46210 is a use-after-free vulnerability in the Linux kernel's media/iris driver. The flaw exists in the Macro Blocks Per Frame (MBPF) checker, which walks the list of active video instances under core->lock and reads fmt_src->width and fmt_src->height fields. Concurrently, iris_close() can free fmt_src and fmt_dst under inst->lock while the instance is still present on the core list. This lock-scope mismatch creates a race condition where the MBPF checker dereferences a dangling pointer. The vulnerability was resolved upstream by deferring the freeing of fmt_src and fmt_dst until after the instance has been removed from the core list.

Critical Impact
Concurrent video instance teardown and MBPF validation can trigger a use-after-free in kernel memory, leading to memory corruption or potential local privilege escalation on affected Linux systems.

Affected Products

Linux kernel containing the media/iris driver
Distributions shipping affected stable kernel branches prior to the upstream fixes
Systems using Qualcomm iris video accelerator hardware support

Discovery Timeline

2026-05-28 - CVE-2026-46210 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46210

Vulnerability Analysis

The media/iris driver supports concurrent video instances, each protected by its own inst->lock. A separate core->lock protects the global list of active instances. The MBPF checker walks this list under core->lock and reads per-instance format fields (fmt_src->width, fmt_src->height) to validate resource limits.

Because the two locks cover different scopes, they do not serialize access to fmt_src and fmt_dst. The iris_close() path holds inst->lock and frees these structures while the instance remains visible on the core list. A second thread executing the MBPF checker can therefore reach an instance whose format pointers have already been freed and dereference them.

The upstream patches reorder teardown so that fmt_src and fmt_dst are released only after the instance has been unlinked from the core list and all teardown under core->lock has completed.

Root Cause

The root cause is a lock-scope mismatch between inst->lock and core->lock. The MBPF checker assumes any instance on the core list is fully valid, but the close path violates that invariant by freeing instance fields before removing the instance from the list. This is a classic use-after-free pattern arising from inconsistent ownership rules between two cooperating locks.

Attack Vector

Triggering this flaw requires local access and the ability to open multiple iris video device instances concurrently. An attacker repeatedly opens, configures, and closes /dev/video* nodes exposed by the iris driver while another thread issues operations that invoke the MBPF checker. Winning the race causes a freed fmt_src pointer to be dereferenced inside the kernel, producing memory corruption that can be steered toward privilege escalation given a suitable heap-shaping primitive.

No verified exploit code is publicly available. The vulnerability mechanism is documented in the upstream commits referenced in the Linux Kernel Commit Update and the follow-up backport commit.

Detection Methods for CVE-2026-46210

Indicators of Compromise

Kernel oops or panic messages referencing iris_close, fmt_src, or MBPF validation routines
KASAN reports of use-after-free in the media/iris subsystem with stack traces involving core->lock
Unexpected processes opening multiple /dev/video* device nodes belonging to the iris driver in rapid succession

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to surface use-after-free conditions in the iris driver during fuzzing or regression runs
Monitor dmesg and journald for kernel BUG, WARN, or KASAN entries originating in drivers/media/platform/qcom/iris
Audit installed kernel package versions against vendor advisories that backport the upstream fixes

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on Oops, general protection fault, and KASAN strings
Track local users invoking V4L2 ioctls on iris devices through audit rules on /dev/video* nodes
Establish a baseline of normal video device usage so abnormal concurrent open/close patterns become visible

How to Mitigate CVE-2026-46210

Immediate Actions Required

Apply the upstream stable kernel updates that include the fixes referenced in the Linux Kernel Commit Update
Restrict access to /dev/video* nodes exposed by the iris driver to trusted users only
Inventory systems running Qualcomm iris-capable hardware and prioritize them for patching

Patch Information

The fix reorders teardown in the media/iris driver so that fmt_src and fmt_dst are freed only after the instance is removed from the core list and all core-lock-protected teardown completes. Rebuild and deploy a kernel that contains both referenced commits, or install the corresponding distribution package once available.

Workarounds

Unload the iris kernel module on systems that do not require hardware video acceleration
Tighten permissions on /dev/video* device nodes via udev rules so only authorized service accounts can open them
Disable concurrent video processing workflows that exercise multiple iris instances simultaneously until patches are applied

bash

# Example: restrict iris video device access via udev
# /etc/udev/rules.d/99-iris-restrict.rules
KERNEL=="video*", SUBSYSTEM=="video4linux", \
    ATTRS{name}=="iris*", MODE="0660", GROUP="video"

# Optionally blacklist the module on systems that do not need it
echo "blacklist iris-vpu" | sudo tee /etc/modprobe.d/blacklist-iris.conf
sudo update-initramfs -u