Executive brief
A vulnerability in the Linux kernel's NXP i.MX8 ISI driver could cause a system crash when the driver module is removed. This component is responsible for image sensing and processing on certain NXP-based hardware. While it primarily affects system stability during maintenance or driver updates, it could potentially be used to cause a denial-of-service on affected devices.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's NXP i.MX8 ISI driver (imx8-isi). The root cause is an incorrect teardown order in the mxc_isi_remove() function, where mxc_isi_crossbar_cleanup() was called before mxc_isi_v4l2_cleanup(). The crossbar cleanup routine frees media entity pads, but the subsequent V4L2 cleanup attempts to access these same pads to remove media links, triggering a slab-use-after-free detected by KASAN. An attacker with sufficient privileges to trigger module removal (rmmod) could cause a kernel panic or memory corruption. The issue has been resolved by reordering the cleanup sequence to ensure V4L2 entities are unregistered before their associated pads are freed.
Affected products
- Linux Linux Kernel 6.4 to 6.10.y
Timeline
- 2026-05-07: disclosed: Initial patch submitted by Xiaolei Wang
- 2026-07-24: patched: Patch merged into stable branches
- 2026-07-25: advisory: CVE-2026-64421 published
References
- https://git.kernel.org/stable/c/b670bf89824ede5d07d20bb9bfbafb754846081d
- https://git.kernel.org/stable/c/ba2aa5d325270cd965c44458c5ff5ab555e6af51
- https://git.kernel.org/stable/c/c12a5b2261351cd3b03921ce4720332ff5184b50
- https://git.kernel.org/stable/c/d22fb719654bfde6f682c9f14629f5f9534175b7
- https://git.kernel.org/stable/c/ef382a6baf0a95cf199fdf6bba2fd08e58b0a249