CVE-2026-43151

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43151", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.989Z", "datePublished": "2026-05-06T11:27:33.084Z", "dateUpdated": "2026-05-23T16:06:26.572Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:06:26.572Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"media: iris: Add sanity check for stop streaming\"\n\nThis reverts commit ad699fa78b59241c9d71a8cafb51525f3dab04d4.\n\nRevert the check that skipped stop_streaming when the instance was in\nIRIS_INST_ERROR, as it caused multiple regressions:\n\n1. Buffers were not returned to vb2 when the instance was already in\n error state, triggering warnings in the vb2 core because buffer\n completion was skipped.\n\n2. If a session failed early (e.g. unsupported configuration), the\n instance transitioned to IRIS_INST_ERROR. When userspace attempted\n to stop streaming for cleanup, stop_streaming was skipped due to the\n added check, preventing proper teardown and leaving the firmware\n in an inconsistent state."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/qcom/iris/iris_vb2.c"], "versions": [{"version": "f8b136296722e258ec43237a35f72c92a6d4501a", "lessThan": "bd4f8fa216182f33c06d4c1e162975a0c42fb14e", "status": "affected", "versionType": "git"}, {"version": "ad699fa78b59241c9d71a8cafb51525f3dab04d4", "lessThan": "a58b9d1c1cf81c0b29f1983c63c3e0c0caa68398", "status": "affected", "versionType": "git"}, {"version": "ad699fa78b59241c9d71a8cafb51525f3dab04d4", "lessThan": "370e19042fb8ac68109f8bdb0fdd8118baf39318", "status": "affected", "versionType": "git"}, {"version": "6.18.3", "lessThan": "6.18.16", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/qcom/iris/iris_vb2.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.3", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bd4f8fa216182f33c06d4c1e162975a0c42fb14e"}, {"url": "https://git.kernel.org/stable/c/a58b9d1c1cf81c0b29f1983c63c3e0c0caa68398"}, {"url": "https://git.kernel.org/stable/c/370e19042fb8ac68109f8bdb0fdd8118baf39318"}], "title": "Revert \"media: iris: Add sanity check for stop streaming\"", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/platform/qcom/iris/iris_vb2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bd4f8fa216182f33c06d4c1e162975a0c42fb14e", "status": "affected", "version": "f8b136296722e258ec43237a35f72c92a6d4501a", "versionType": "git"}, {"lessThan": "a58b9d1c1cf81c0b29f1983c63c3e0c0caa68398", "status": "affected", "version": "ad699fa78b59241c9d71a8cafb51525f3dab04d4", "versionType": "git"}, {"lessThan": "370e19042fb8ac68109f8bdb0fdd8118baf39318", "status": "affected", "version": "ad699fa78b59241c9d71a8cafb51525f3dab04d4", "versionType": "git"}, {"lessThan": "6.18.16", "status": "affected", "version": "6.18.3", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/platform/qcom/iris/iris_vb2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "467D065A-A7C4-4E16-81D4-A299BE23E234", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.18.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"media: iris: Add sanity check for stop streaming\"\n\nThis reverts commit ad699fa78b59241c9d71a8cafb51525f3dab04d4.\n\nRevert the check that skipped stop_streaming when the instance was in\nIRIS_INST_ERROR, as it caused multiple regressions:\n\n1. Buffers were not returned to vb2 when the instance was already in\n error state, triggering warnings in the vb2 core because buffer\n completion was skipped.\n\n2. If a session failed early (e.g. unsupported configuration), the\n instance transitioned to IRIS_INST_ERROR. When userspace attempted\n to stop streaming for cleanup, stop_streaming was skipped due to the\n added check, preventing proper teardown and leaving the firmware\n in an inconsistent state."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRevertir \u2019media: iris: A\u00f1adir comprobaci\u00f3n de cordura para detener la transmisi\u00f3n\u2019\n\nEsto revierte el commit ad699fa78b59241c9d71a8cafb51525f3dab04d4.\n\nRevertir la comprobaci\u00f3n que omit\u00eda stop_streaming cuando la instancia estaba en IRIS_INST_ERROR, ya que caus\u00f3 m\u00faltiples regresiones:\n\n1. Los b\u00faferes no se devolv\u00edan a vb2 cuando la instancia ya estaba en estado de error, lo que activaba advertencias en el n\u00facleo de vb2 porque se omit\u00eda la finalizaci\u00f3n del b\u00fafer.\n\n2. Si una sesi\u00f3n fallaba temprano (p. ej., configuraci\u00f3n no compatible), la instancia pasaba a IRIS_INST_ERROR. Cuando el espacio de usuario intentaba detener la transmisi\u00f3n para la limpieza, stop_streaming se omit\u00eda debido a la comprobaci\u00f3n a\u00f1adida, lo que imped\u00eda un desmontaje adecuado y dejaba el firmware en un estado inconsistente."}], "id": "CVE-2026-43151", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-06T12:16:32.827", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/370e19042fb8ac68109f8bdb0fdd8118baf39318"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a58b9d1c1cf81c0b29f1983c63c3e0c0caa68398"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bd4f8fa216182f33c06d4c1e162975a0c42fb14e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: Revert \"media: iris: Add sanity check for stop streaming\"", "id": "2467085", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467085"}, "csaw": false, "details": ["No description is available for this CVE."], "name": "CVE-2026-43151", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43151\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43151\nhttps://lore.kernel.org/linux-cve-announce/2026050628-CVE-2026-43151-e861@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f8b136296722e258ec43237a35f72c92a6d4501a,bd4f8fa216182f33c06d4c1e162975a0c42fb14e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ad699fa78b59241c9d71a8cafb51525f3dab04d4,a58b9d1c1cf81c0b29f1983c63c3e0c0caa68398)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ad699fa78b59241c9d71a8cafb51525f3dab04d4,370e19042fb8ac68109f8bdb0fdd8118baf39318)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.16,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T13:45:04.298246+00:00", "title": "Linux kernel iris media driver and firmware inconsistency due to skipped stop_streaming during error state", "updated": "2026-05-14T00:00:07.977753+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-401", "CWE-795"]}