Use-After-Free Vulnerability in Linux Kernel Affecting Media Processing

CVE-2026-46210

What is CVE-2026-46210?

The vulnerability in the Linux kernel involves a use-after-free condition occurring during the Macro Blocks Per Frame (MBPF) checking process. Due to concurrent instances operating under different locking mechanisms, the core list of active instances may encounter a state where an instance's fmt_src and fmt_dst are freed while still being accessed. If the MBPF checker, operating under core->lock, attempts to read these fields while they are freed by another thread, it results in dereferencing a dangling pointer. This situation arises from improper synchronization and highlights the need for meticulous management of instance lifecycles and resource deallocation to prevent exposure of invalid pointers.

References