CVE-2026-89522: media: staging/ipu7: fix async notifier UAF on probe error path
In the Linux kernel, the following vulnerability has been resolved:
media: staging/ipu7: fix async notifier UAF on probe error path
isysregisterdevices() registers the V4L2 async notifier via isysnotifierinit(). If a subsequent probe step such as isysfwloginit() fails, isysprobe() jumps to the outcleanup label which only calls isysunregisterdevices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier.
As a result the notifier stays chained in the global notifierlist while the enclosing struct ipu7isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked.
The remove path already does the right thing by calling isysnotifiercleanup() before isysunregisterdevices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down.
Affected Software
Event History
Frequently Asked Questions
Is normal device removal affected by the same cleanup failure?
No. The remove path already calls isys_notifier_cleanup() before isys_unregister_devices(); the issue is limited to the probe error path.
When can the stale notifier be left behind?
It occurs when isys_register_devices() has registered the async notifier and a later probe step, such as isys_fw_log_init(), fails. The enclosing ipu7_isys structure can then be freed while its notifier remains on the global notifier list.