CVE-2026-68220: media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe
In the Linux kernel, the following vulnerability has been resolved:
media: nxp: imx8-isi: Add missing v4l2subdevcleanup() in crossbar and pipe
Both mxcisicrossbarinit() and mxcisipipeinit() call v4l2subdevinitfinalize() which allocates the subdev active state, but neither mxcisicrossbarcleanup() nor mxcisipipecleanup() calls v4l2subdevcleanup() to free it.
This causes a memory leak on every rmmod, reported by kmemleak:
unreferenced object 0xffff0000d06fc800 (size 192): comm "(udev-worker)", pid 254, jiffies 4294913455 backtrace (crc 36eeae58): kmemleakalloc+0x34/0x40 kvmallocnodenoprof+0x5f8/0x7d8 v4l2subdevstatealloc+0x1fc/0x30c v4l2subdevinitfinalize+0x178/0x368
Add the missing v4l2subdevcleanup() calls before mediaentitycleanup() in both crossbar and pipe cleanup paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the imx8-isi driver, update mxc_isi_crossbar_cleanup() and mxc_isi_pipe_cleanup() so that they call v4l2_subdev_cleanup() for their v4l2_subdev instances before calling media_entity_cleanup() (to fix the kmemleak-triggering leak on rmmod).
Linux kernel (media: nxp: imx8-isi) Call v4l2_subdev_cleanup() during cleanup = Add v4l2_subdev_cleanup() calls before media_entity_cleanup() in both mxc_isi_crossbar_cleanup() and mxc_isi_pipe_cleanup()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68220?
CVE-2026-68220 has a risk rating of 6, indicating a medium severity vulnerability.
How do I fix CVE-2026-68220?
To fix CVE-2026-68220, update the Linux kernel to the latest version where this vulnerability has been addressed.
What systems are affected by CVE-2026-68220?
CVE-2026-68220 affects systems utilizing the Linux kernel with the media driver related to NXP i.MX8 Image Signal Interface.
What could happen if CVE-2026-68220 is exploited?
Exploitation of CVE-2026-68220 could lead to undefined behavior and potential instability in the media handling components of the Linux kernel.
When was CVE-2026-68220 published?
CVE-2026-68220 was published on August 10, 2026.