PT-2026-64668 · Linux · Linux
CVE-2026-64447
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
staging: media: ipu7: fix double-free and use-after-free in error paths
In both ipu7 isys init() and ipu7 psys init(), pdata is allocated and
then passed to ipu7 bus initialize device(), which stores it in
adev->pdata. The ipu7 bus release() function frees adev->pdata when the
device's reference count drops to zero.
Two error paths incorrectly call kfree(pdata) after the device teardown
has already freed it:
-
When ipu7 mmu init() fails: put device() is called, which drops the reference count to zero and triggers ipu7 bus release() -> kfree(pdata). The subsequent kfree(pdata) is a double-free.
-
When ipu7 bus add device() fails: it calls auxiliary device uninit() internally, which calls put device() -> ipu7 bus release() -> kfree(pdata). The subsequent kfree(pdata) is again a double-free.
Note that the kfree(pdata) when ipu7 bus initialize device() itself
fails is correct, because in that case auxiliary device init() failed
and the release function was never set up, so pdata must be freed
manually.
Additionally, the error code was not saved before calling put device(),
causing ERR CAST() to dereference the already-freed adev pointer when
constructing the return value. Fix this by saving the error from
dev err probe() before put device() and returning ERR PTR() instead.
Remove the redundant kfree(pdata) calls and fix the use-after-free in
the return values of the two affected error paths.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux