Executive brief
The Linux kernel's Intel IPU6 (Imaging Processing Unit) media driver contains a memory leak in its notifier initialization error handling. When endpoint parsing fails during device setup, the driver fails to clean up previously allocated resources, allowing memory to accumulate. While this is a localized resource leak, it can degrade system stability over time if triggered repeatedly.
Technical details
The vulnerability is a resource leak (CWE-401) in the isys_notifier_init() function within the Intel IPU6 media driver. The function initializes a v4l2 async notifier and loops through firmware node remote subdevices, adding each via v4l2_async_nf_add_fwnode_remote(). If endpoint parsing or device addition fails partway through the loop, the error path jumps to err_parse without calling v4l2_async_nf_cleanup(), leaking all v4l2_async_connection objects already queued in the notifier's waiting list. The fix adds a v4l2_async_nf_cleanup() call to the error path. This is a local issue triggered during device initialization; no network or special privileges are required to encounter it when the hardware is present.
Affected products
- Linux Linux kernel 5.0 and later (affecting ipu6 driver)
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-08-08: patched: Upstream fix committed by Cong Nguyen
- 2026-09-11: patched: Merged into stable kernel by Greg Kroah-Hartman