The Linux kernel's media iris driver contained a use-after-free vulnerability in the iris_release_internal_buffers() function. A recent commit introduced a regression where session_release_buf() could free a buffer, but iris_release_internal_buffers() continued to access it afterward, causing a use-after-free condition. The fix involves setting a buffer attribute flag before calling session_release_buf() to prevent dereferencing freed memory and reverting the flag if the call fails. This vulnerability affects multiple Linux kernel versions prior to 7.0.0-28.28 and related variants. The issue has been assigned CVE-2026-46240 and has a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Successful exploitation of this use-after-free vulnerability could lead to memory corruption, potentially allowing an attacker with local privileges to escalate their privileges, compromise system confidentiality, integrity, and availability. The CVSS score reflects high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

A patch is available and should be applied by updating the Linux kernel to versions 7.0.0-28.28 or later (and related fixed versions). The vendor advisory from Ubuntu confirms the fix and recommends performing a standard system update followed by a reboot. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigation steps are indicated beyond applying the official update.