Linux Kernel EUVD-2026-27708

The iris driver is part of the Linux kernel's V4L2 media subsystem (drivers/media/platform/qcom/iris), used for Qualcomm hardware video encode/decode acceleration. The vulnerability resides in the buffer management logic for internal DMA buffers. The function list_add_tail() was called to enqueue a buffer struct into buffers->list before dma_alloc_attrs() was invoked to back that buffer with actual DMA-coherent memory. On allocation failure, the function returned -ENOMEM, but the list node remained in the linked list pointing to a struct with uninitialized or zeroed DMA fields. Any subsequent kernel code iterating that list and dereferencing the DMA address or virtual pointer of that buffer would encounter invalid memory, potentially triggering a kernel panic or use-after-free-equivalent condition. CPE data identifies the affected product as cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* and the vulnerability was introduced at commit 73702f45db81b74897b2808aaa13484826156006. CWE is not formally assigned, but the root cause class is improper cleanup on error path (closest to CWE-459: Incomplete Cleanup or CWE-754: Improper Check for Exceptional Conditions).