CVE-2026-46240: media: iris: Fix use-after-free in iris_release_internal_buffers()

Synopsis

A use-after-free vulnerability exists in the Linux kernel's iris media driver, specifically in the iris_release_internal_buffers() function. The flaw is reachable locally by a low-privileged user and does not require any network access or user interaction. Successful exploitation gives an attacker full read, write, and crash capability over the affected system. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the vulnerable code is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable code path in iris_release_internal_buffers().

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the vulnerability directly without involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, specific memory layout, or other environmental pre-conditions beyond local access.

Blast Radius

• Reads arbitrary kernel memory, exposing credentials, session tokens, or other sensitive in-kernel data.
• Writes to arbitrary kernel memory, allowing modification of kernel data structures or persisted state.
• Crashes the affected kernel, causing a full system denial of service for all workloads on the host.
• May be chained into a full local privilege escalation by corrupting kernel control-flow data.