The patch committed as 1dabf00ee206 reveals that a regression in the Linux kernel’s media iris driver allows a use‑after‑free condition. When session_release_buf() frees a buffer, iris_release_internal_buffers() subsequently accesses that freed buffer, which can lead to unstable kernel behavior. The fix introduces a pending‑release flag to prevent any dereference after a possible free.

All Linux kernel builds prior to the commit that adds the pending‑release guard are vulnerable. This includes any system using the iris media driver without the 1dabf00ee206 change, regardless of distribution or kernel version.

The vulnerability is local; an attacker must be able to trigger the iris_release_internal_buffers() code path, usually by controlling an iris media session. The EPSS score of less than 1 % indicates a low probability of exploitation in the wild, but the CVSS score of 7.8 signals high severity, primarily due to potential kernel instability. The flaw is not listed in the CISA KEV catalog.