A flaw in the Linux kernel media subsystem allows a partially initialized buffer to be added to the internal buffers list even when its DMA allocation fails. The buffer remains in the list in a corrupted state, and any later code that traverses this list may operate on invalid data, potentially leading to data leaks or a kernel crash. This is a classic instance of partial initialization of kernel memory that can be exploited for improper use of pointers (CWE‑908, NVD-CWE-noinfo).

All Linux kernel distributions that include the media:iris component and have not applied the patch that moves the list addition after a successful DMA allocation are affected. The commit fixing the issue was merged into the kernel source in early 2026, so any kernel releases before that point remain vulnerable.

The likely attack vector is local or privileged execution that triggers the media subsystem’s DMA allocation routine. Because the defect exists in kernel code, remote exploitation would first require elevated privileges. The EPSS score is < 1% and the CVSS score is 5.5, and the vulnerability is not listed in the CISA KEV catalog, indicating no documented exploitation. The overall risk is moderate: a local condition that forces the dirty list item into use can cause a kernel panic, resulting in a denial of service for the affected system.