In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix use-after-free in iris_release_internal_buffers() The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") introduced a regression where session_release_buf() may free the buffer. The caller, iris_release_internal_buffers(), continued to access `buffer` after the call, leading to a potential use-after-free. Fix this by setting BUF_ATTR_PENDING_RELEASE before calling session_release_buf(), and reverting the flag if the call fails. This ensures no dereference occurs after potential freeing.

A flaw was found in the Linux kernel, specifically within the `media: iris` driver. This vulnerability, a use-after-free, occurs when a buffer is prematurely freed by `session_release_buf()` while `iris_release_internal_buffers()` continues to access it. This improper handling of memory can lead to system instability, crashes, or potentially allow an attacker to gain unauthorized access or execute arbitrary code.

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-46240 https://nvd.nist.gov/vuln/detail/CVE-2026-46240 https://lore.kernel.org/linux-cve-announce/2026052841-CVE-2026-46240-7e99@gregkh/T