The Linux kernel media:iris driver was changed by adding a sanity check that prevented the stop_streaming function from being called when the instance was in an error state. This change caused buffers to remain allocated, triggering warnings and preventing proper teardown of the driver when a session failed early. The result is a resource leak and an inconsistent firmware state that could lead to system instability or denial of service on affected media devices.

The vulnerability affects the Linux kernel in all releases that contain the commit adding the sanity check for iris devices. The exact version range is not specified, but any system with the iris driver after the problematic commit is potentially affected.

The vulnerability has no publicly reported exploits and no EPSS score is available. It is a local issue that requires privileged access to the kernel through a userspace interaction with the iris driver. The lack of a KEV listing and the absence of a CVSS score suggest moderate risk; however, if an attacker can trigger a streaming error on an iris device they may force a resource exhaustion condition.