CVE-2026-64447
Received Received - Intake

Double-Free and Use-After-Free in Linux Kernel IPU7 Media Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7_isys_init() and ipu7_psys_init(), pdata is allocated and then passed to ipu7_bus_initialize_device(), which stores it in adev->pdata. The ipu7_bus_release() function frees adev->pdata when the device's reference count drops to zero. Two error paths incorrectly call kfree(pdata) after the device teardown has already freed it: 1. When ipu7_mmu_init() fails: put_device() is called, which drops the reference count to zero and triggers ipu7_bus_release() -> kfree(pdata). The subsequent kfree(pdata) is a double-free. 2. When ipu7_bus_add_device() fails: it calls auxiliary_device_uninit() internally, which calls put_device() -> ipu7_bus_release() -> kfree(pdata). The subsequent kfree(pdata) is again a double-free. Note that the kfree(pdata) when ipu7_bus_initialize_device() itself fails is correct, because in that case auxiliary_device_init() failed and the release function was never set up, so pdata must be freed manually. Additionally, the error code was not saved before calling put_device(), causing ERR_CAST() to dereference the already-freed adev pointer when constructing the return value. Fix this by saving the error from dev_err_probe() before put_device() and returning ERR_PTR() instead. Remove the redundant kfree(pdata) calls and fix the use-after-free in the return values of the two affected error paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64447
EUVD
EUVD-2026-48791

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves double-free and use-after-free issues in error paths of the IPU7 media driver. Specifically, in functions ipu7_isys_init() and ipu7_psys_init(), memory allocated for pdata is freed twice when certain errors occur. The first free happens during device teardown via ipu7_bus_release(), and the second occurs due to redundant kfree(pdata) calls in error paths. Additionally, a use-after-free flaw exists where an error code is not saved before freeing resources, leading to dereferencing of freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's staging media IPU7 subsystem and requires kernel-level inspection. Detection involves checking kernel logs for errors related to ipu7_isys_init() or ipu7_psys_init() failures, double-frees, or use-after-free events. Commands like dmesg | grep -i ipu7 or journalctl -k | grep -i ipu7 may help identify such issues.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or potential privilege escalation if exploited. Systems running vulnerable Linux kernel versions with the IPU7 media driver enabled may experience instability or security breaches due to memory management issues.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the double-free and use-after-free issues in the IPU7 subsystem. If patches are unavailable, consider disabling the affected IPU7 media drivers via kernel module blacklisting or recompiling the kernel without the staging media IPU7 support.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64447. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart