CVE-2026-80650: media: atomisp: gc2235: fix UAF and memory leak
In the Linux kernel, the following vulnerability has been resolved:
media: atomisp: gc2235: fix UAF and memory leak
gc2235probe() handles its error paths incorrectly.
If mediaentitypadsinit() fails, gc2235remove() is called, which tears down the subdev and frees dev, but then still falls through to atomispregisteri2cmodule(). This results in use-after-free.
If atomispregisteri2cmodule() fails, the media entity and control handler are left initialized and dev is leaked.
gc2235remove() unconditionally calls mediaentitycleanup() and v4l2ctrlhandlerfree(), but these are not initialized at every error path in gc2235probe().
Replace gc2235remove() calls in the probe error paths with explicit unwind labels that free only the resources initialized at each point of failure, in reverse order of initialization.
Affected Software
Event History
Frequently Asked Questions
When can this issue be triggered?
It is triggered during gc2235 driver probing when initialization fails, specifically if media_entity_pads_init() fails or if atomisp_register_i2c_module() fails afterward. The affected paths mishandle cleanup for partially initialized resources.
What is the impact of the failed probe paths?
A media_entity_pads_init() failure can lead to a use-after-free because the driver frees its device state and then continues to register the I2C module. A later atomisp_register_i2c_module() failure can leave initialized resources behind and leak the device allocation.
How is the issue fixed?
The fix replaces gc2235_remove() calls on probe failure paths with explicit cleanup labels. Each label releases only resources that were successfully initialized, in reverse initialization order.