CVE-2026-80650: media: atomisp: gc2235: fix UAF and memory leak

Published Aug 28, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

media: atomisp: gc2235: fix UAF and memory leak

gc2235probe() handles its error paths incorrectly.

If mediaentitypadsinit() fails, gc2235remove() is called, which tears down the subdev and frees dev, but then still falls through to atomispregisteri2cmodule(). This results in use-after-free.

If atomispregisteri2cmodule() fails, the media entity and control handler are left initialized and dev is leaked.

gc2235remove() unconditionally calls mediaentitycleanup() and v4l2ctrlhandlerfree(), but these are not initialized at every error path in gc2235probe().

Replace gc2235remove() calls in the probe error paths with explicit unwind labels that free only the resources initialized at each point of failure, in reverse order of initialization.

Affected Software

1 affected component
Linux Linux kernel

Event History

Aug 28, 2026
CVE Published
via MITRE·06:48 AM
Data Sourced
via MITRE·06:48 AM
Description

Frequently Asked Questions

1

When can this issue be triggered?

It is triggered during gc2235 driver probing when initialization fails, specifically if media_entity_pads_init() fails or if atomisp_register_i2c_module() fails afterward. The affected paths mishandle cleanup for partially initialized resources.

2

What is the impact of the failed probe paths?

A media_entity_pads_init() failure can lead to a use-after-free because the driver frees its device state and then continues to register the I2C module. A later atomisp_register_i2c_module() failure can leave initialized resources behind and leak the device allocation.

3

How is the issue fixed?

The fix replaces gc2235_remove() calls on probe failure paths with explicit cleanup labels. Each label releases only resources that were successfully initialized, in reverse initialization order.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203