CVE-2026-46210

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: iris: fix use-after-free of fmt_src during MBPF check

During concurrency testing, multiple instances can run in parallel, and

each instance uses its own inst->lock while the core->lock protects the

list of active instances. The race happens because these locks cover

different scopes, inst->lock protects only the internals of a single

instance, while the Macro Blocks Per Frame (MBPF) checker walks the

core list under core->lock and reads fields like fmt_src->width and

fmt_src->height. At the same time, iris_close() may free fmt_src and

fmt_dst under inst->lock while the instance is still present in the core

list. This allows a situation where the MBPF checker, still iterating

through the core list, reaches an instance whose fmt_src was already

freed by another thread and ends up dereferencing a dangling pointer,

resulting in a use-after-free. This happens because the MBPF checker

assumes that any instance in th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References