Skip to main content

Linux Kernel CVE-2026-43217

| EUVDEUVD-2026-27779 MEDIUM
Memory Leak (CWE-401)
2026-05-06 Linux GHSA-wq78-4w69-8m35
Denial Of Service Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access and low-privilege V4L2 device access required; crash produces only availability impact with no confidentiality or integrity consequence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:01 vuln.today
CVSS changed
May 11, 2026 - 19:37 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: iris: gen2: Add sanity check for session stop

In iris_kill_session, inst->state is set to IRIS_INST_ERROR and session_close is executed, which will kfree(inst_hfi_gen2->packet). If stop_streaming is called afterward, it will cause a crash.

Add a NULL check for inst_hfi_gen2->packet before sendling STOP packet to firmware to fix that.

AnalysisAI

Kernel panic in the Linux iris gen2 media driver can be triggered by a local low-privileged user when a sequencing flaw between iris_kill_session and stop_streaming causes a NULL dereference of a freed packet buffer. The iris driver - used for Qualcomm video codec hardware - frees inst_hfi_gen2->packet during session teardown via kfree, but stop_streaming lacks a guard against subsequently dereferencing that pointer when sending a STOP command to firmware, resulting in a system crash. No public exploit code exists, EPSS is 0.02% (4th percentile), and vendor-released patches are confirmed across multiple stable kernel branches.

Technical ContextAI

The iris driver is a V4L2 media subsystem component in the Linux kernel that supports Qualcomm's iris video codec hardware (generation 2). The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), though the operational behavior is closer to CWE-476 (NULL Pointer Dereference): iris_kill_session() sets the instance state to IRIS_INST_ERROR and calls session_close(), which invokes kfree(inst_hfi_gen2->packet), releasing the packet buffer. If stop_streaming is subsequently invoked - a plausible sequence during abnormal session teardown - it attempts to use that same freed pointer to send a STOP packet to firmware, triggering a kernel panic. The fix introduced a NULL check for inst_hfi_gen2->packet prior to the firmware send. Affected CPEs are cpe:2.3:a:linux:linux across multiple stable branches, with fixes landing in commits 72846441c5f6, 9aa8d63d09cf, and 75992ba43072 on kernel.org stable trees.

RemediationAI

Upgrade the Linux kernel to version 6.18.16 or 6.19.6, which contain the validated fix. For systems tracking the upstream stable tree, the specific corrective commits are 72846441c5f6396de9face04e77fa3d28e9915b6 (stable/6.18), 9aa8d63d09cfc44d879427cc5ba308012ca4ab8e (mainline), and 75992ba43072674fd4767df62a1fe2048565cc60 (stable/6.19), all available at https://git.kernel.org/stable/c/. Red Hat and SUSE users should apply distribution-specific errata when issued. As a compensating control on systems where patching is delayed, unloading or blacklisting the iris kernel module (modprobe -r iris or adding it to /etc/modprobe.d/blacklist.conf) eliminates exposure entirely, with the trade-off of disabling Qualcomm video codec hardware functionality. This workaround is appropriate only for systems where video encode/decode via iris hardware is not operationally required.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43217 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy