PT-2026-64668 · Linux · Linux
CVE-2026-64447
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
staging: media: ipu7: fix double-free and use-after-free in error paths
In both ipu7 isys init() and ipu7 psys init(), pdata is allocated and
then passed to ipu7 bus initialize device(), which stores it in
adev->pdata. The ipu7 bus release() function frees adev->pdata when the
device's reference count drops to zero.
Two error paths incorrectly call kfree(pdata) after the device teardown
has already freed it:
-
When ipu7 mmu init() fails: put device() is called, which drops the reference count to zero and triggers ipu7 bus release() -> kfree(pdata). The subsequent kfree(pdata) is a double-free.
-
When ipu7 bus add device() fails: it calls auxiliary device uninit() internally, which calls put device() -> ipu7 bus release() -> kfree(pdata). The subsequent kfree(pdata) is again a double-free.
Note that the kfree(pdata) when ipu7 bus initialize device() itself
fails is correct, because in that case auxiliary device init() failed
and the release function was never set up, so pdata must be freed
manually.
Additionally, the error code was not saved before calling put device(),
causing ERR CAST() to dereference the already-freed adev pointer when
constructing the return value. Fix this by saving the error from
dev err probe() before put device() and returning ERR PTR() instead.
Remove the redundant kfree(pdata) calls and fix the use-after-free in
the return values of the two affected error paths.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux