CVE-2026-89522

Received Received - Intake

Use-After-Free in Linux Kernel IPU7 Media Driver

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys_register_devices() registers the V4L2 async notifier via isys_notifier_init(). If a subsequent probe step such as isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label which only calls isys_unregister_devices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier. As a result the notifier stays chained in the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked. The remove path already does the right thing by calling isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89522

EUVD

EUVD-2026-76428

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's media subsystem. It occurs in the IPU7 (Image Processing Unit) driver during probe error handling. When a probe fails after registering an async notifier, the cleanup process does not properly unregister the notifier, leaving it in a global list. Later, when the list is accessed, it causes memory corruption and a use-after-free due to the freed device structure.

Detection Guidance

This vulnerability is specific to the Linux kernel's media subsystem and requires kernel-level inspection. Detection involves checking kernel logs for media subsystem errors or crashes during device probing. Use commands like dmesg | grep -i ipu7 or journalctl -k | grep -i ipu7 to search for related errors. If the system is affected, these commands may show use-after-free or list corruption messages during device initialization.

Impact Analysis

This vulnerability could lead to system instability, crashes, or potential privilege escalation if exploited. It primarily affects systems using the IPU7 media driver in the Linux kernel. Attackers might trigger the error path to cause denial-of-service conditions or execute arbitrary code.

Mitigation Strategies

Apply the latest kernel updates from your Linux distribution to ensure the fix is included. If immediate patching is not possible, avoid using affected media devices or disable the ipu7_isys module via modprobe.blacklist=ipu7_isys. Monitor kernel logs for errors and consider isolating systems using media devices until patched.

Hi! I’m here to help you understand CVE-2026-89522. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70