PT-2026-64642 · Linux · Linux
CVE-2026-64421
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
media: nxp: imx8-isi: Fix use-after-free on remove
KASAN reports a slab-use-after-free in media entity remove link()
during rmmod of imx8 isi:
BUG: KASAN: slab-use-after-free in media entity remove link+0x608/0x650
Read of size 2 at addr ffff0000d47cb02a by task rmmod/724
Call trace:
media entity remove link+0x608/0x650
media entity remove links+0x78/0x144
media device unregister entity+0x150/0x280
media device unregister entity+0x48/0x68
v4l2 device unregister subdev+0x158/0x300
v4l2 async unbind subdev one+0x22c/0x358
v4l2 async nf unbind all subdevs+0xfc/0x1c0
v4l2 async nf unregister+0x5c/0x14c
mxc isi remove+0x124/0x2a0 [imx8 isi]
Allocated by task 249:
kmalloc noprof+0x27c/0x690
mxc isi crossbar init+0x22c/0x560 [imx8 isi]
Freed by task 724:
kfree+0x1e4/0x5b0
mxc isi crossbar cleanup+0x34/0x80 [imx8 isi]
mxc isi remove+0x11c/0x2a0 [imx8 isi]
The problem is that mxc isi remove() calls mxc isi crossbar cleanup()
before mxc isi v4l2 cleanup(). The crossbar cleanup frees the media
entity pads, but the subsequent v4l2 cleanup still tries to remove
media links that reference those pads.
Fix this by calling mxc isi v4l2 cleanup() before
mxc isi crossbar cleanup() to ensure all media entities are properly
unregistered while the pads are still valid.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux