CVE-2026-43146
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
06/05/2026
Last modified:
13/05/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
media: iris: Add buffer to list only after successful allocation<br />
<br />
Move `list_add_tail()` to after `dma_alloc_attrs()` succeeds when creating<br />
internal buffers. Previously, the buffer was enqueued in `buffers->list`<br />
before the DMA allocation. If the allocation failed, the function returned<br />
`-ENOMEM` while leaving a partially initialized buffer in the list, which<br />
could lead to inconsistent state and potential leaks.<br />
<br />
By adding the buffer to the list only after `dma_alloc_attrs()` succeeds,<br />
we ensure the list contains only valid, fully initialized buffers.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.15 (including) | 6.18.16 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.19 (including) | 6.19.6 (excluding) |
To consult the complete list of CPE names with products and versions, see this page