The iris media driver in the Linux kernel contains a race condition that allows a use‑after‑free when the MBPF checker traverses the core instance list concurrently with an iris close operation that frees fmt_src and fmt_dst. If the checker dereferences a freed pointer, the kernel can crash or an attacker could execute arbitrary code with kernel privileges.

All Linux kernels that include the iris media driver before the patch commits 3d9593ad1a58c5acc3e5fa2a48222bb7632e6812 or 494ffd1712a588e590e6b1e9f876a8c8b24a9180 are potentially affected. Affected systems are those that load the iris module without the patch, regardless of kernel version because no explicit version numbers were listed.

Kernel use‑after‑free vulnerabilities are rated high severity; the CVSS score for this flaw is 7.8. The EPSS score is <1%, indicating a very low exploitation probability, and the flaw is not listed in CISA KEV, suggesting no widespread exploitation reports yet. However, the race condition is feasible during normal driver activity. Exploitation would require an attacker to trigger concurrent iris operations that lead to a dangling pointer dereference; no additional privileges are needed beyond those required to control the iris driver, making this a local privilege escalation vector for affected systems.