CVE-2026-64421: media: nxp: imx8-isi: Fix use-after-free on remove
In the Linux kernel, the following vulnerability has been resolved:
media: nxp: imx8-isi: Fix use-after-free on remove
KASAN reports a slab-use-after-free in mediaentityremovelink() during rmmod of imx8isi:
BUG: KASAN: slab-use-after-free in mediaentityremovelink+0x608/0x650 Read of size 2 at addr ffff0000d47cb02a by task rmmod/724
Call trace: mediaentityremovelink+0x608/0x650 mediaentityremovelinks+0x78/0x144 mediadeviceunregisterentity+0x150/0x280 mediadeviceunregisterentity+0x48/0x68 v4l2deviceunregistersubdev+0x158/0x300 v4l2asyncunbindsubdevone+0x22c/0x358 v4l2asyncnfunbindallsubdevs+0xfc/0x1c0 v4l2asyncnfunregister+0x5c/0x14c mxcisiremove+0x124/0x2a0 [imx8isi]
Allocated by task 249: kmallocnoprof+0x27c/0x690 mxcisicrossbarinit+0x22c/0x560 [imx8isi]
Freed by task 724: kfree+0x1e4/0x5b0 mxcisicrossbarcleanup+0x34/0x80 [imx8isi] mxcisiremove+0x11c/0x2a0 [imx8isi]
The problem is that mxcisiremove() calls mxcisicrossbarcleanup() before mxcisiv4l2cleanup(). The crossbar cleanup frees the media entity pads, but the subsequent v4l2 cleanup still tries to remove media links that reference those pads.
Fix this by calling mxcisiv4l2cleanup() before mxcisicrossbarcleanup() to ensure all media entities are properly unregistered while the pads are still valid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the slab-use-after-free on removal by changing imx8_isi cleanup/remove logic so that mxc_isi_v4l2_cleanup() is called before mxc_isi_crossbar_cleanup() during mxc_isi_remove().
Linux kernel module imx8_isi (media: nxp: imx8-isi) remove order = Call mxc_isi_v4l2_cleanup() before media link removal/Crossbar cleanup
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel imx8_isi media driver are implicated. The reported failure occurs while removing the imx8_isi module.
What access does an attacker need to exploit it?
The CVSS vector indicates local access with low privileges and no user interaction. The vulnerability has high confidentiality, integrity, and availability impact in that vector.
How can I tell whether the system is affected?
A KASAN-enabled kernel may report a slab-use-after-free in __media_entity_remove_link() during rmmod of imx8_isi. The trace includes mxc_isi_remove(), mxc_isi_crossbar_cleanup(), and media/V4L2 entity or link cleanup functions.
What does the fix change?
The fix corrects the removal cleanup ordering so V4L2 cleanup removes media links before crossbar cleanup frees the media-entity pads those links reference.