The Linux kernel media driver for Iris Gen2 contains a flaw in the session termination routine. When a session is killed, the driver frees the packet buffer and later, if a stop command is issued, it attempts to use the freed pointer to send a STOP packet to the firmware. This dereference of a freed memory area causes a kernel panic and a full system crash. The vulnerability aligns with CWE-401 and CWE-825.

All Linux kernel builds that include the upstream media:iris gen2 driver before the NULL‑check commit are vulnerable. The vendor list in the CVE cites the core Linux kernel, so any distribution kernel that ships this driver and has Iris hardware present is at risk until the patch is applied. Specific kernel versions are not enumerated in the advisory, so the safest assumption is that any kernel containing the unmitigated driver could be affected.

The vulnerability requires local interaction with the iris driver, typically through ioctl calls or user‑space applications that exercise session control. A local attacker or a compromised privileged process can trigger the crash by issuing a session stop after the session has been killed. EPSS score of < 1% indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog, but the potential for a kernel panic represents a high‑risk denial‑of‑service condition for affected systems. The CVSS score for this vulnerability is 5.5.