Executive brief
The Linux kernel's IPU7 media driver (used for image sensor processing) contains a use-after-free vulnerability in its device initialization error handling. When the driver fails to initialize during device probe, it incorrectly frees internal structures while leaving the async notifier registered, causing memory corruption and crashes on subsequent operations. This can lead to kernel panics and denial of service on affected systems.
Technical details
A use-after-free vulnerability exists in the IPU7 input system driver (drivers/staging/media/ipu7/ipu7-isys.c). The isys_probe() function registers a V4L2 async notifier via isys_notifier_init() but fails to unregister it during the error cleanup path. When a subsequent initialization step (e.g., isys_fw_log_init()) fails, the code jumps to out_cleanup which calls isys_unregister_devices(), but this does not clean up the async notifier. The notifier remains chained in the global notifier_list while the containing struct ipu7_isys is freed, leading to list corruption and UAF when the list is next traversed. The fix adds isys_notifier_cleanup() to the probe error path before isys_unregister_devices(), mirroring the correct cleanup sequence already present in the remove path. No authentication or user interaction is required; local or direct physical access to trigger device probe/initialization is sufficient.
Affected products
- Linux Linux kernel staging IPU7 driver (media/ipu7)
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched: Patch committed to stable kernel trees