CVE-2026-89886: media: intel/ipu6: fix async notifier cleanup leak on parse error
In the Linux kernel, the following vulnerability has been resolved:
media: intel/ipu6: fix async notifier cleanup leak on parse error
isysnotifierinit() calls v4l2asyncnfinit() and then adds fwnode remote subdevs in a loop with v4l2asyncnfaddfwnoderemote(). If an endpoint parse or add fails partway through the loop, it jumps to errparse and returns without calling v4l2asyncnfcleanup(), leaking every v4l2asyncconnection already added to the notifier's waiting list.
The register-failure path just below already cleans up correctly, and the caller only tears the notifier down (isysnotifiercleanup()) once isysnotifierinit() has returned success. Clean up the notifier on the parse error path too.
Affected Software
Event History
Frequently Asked Questions
Under what condition does the resource leak occur?
The leak occurs when isys_notifier_init() has already added one or more remote fwnode subdevices, then an endpoint parse or a subsequent v4l2_async_nf_add_fwnode_remote() call fails. The parse-error path returns without cleaning the notifier's waiting list.
Does later notifier teardown clean up allocations from a failed initialization?
No. The caller invokes isys_notifier_cleanup() only after isys_notifier_init() returns successfully, so it does not clean up connections allocated before an initialization failure. The corrected parse-error path explicitly calls v4l2_async_nf_cleanup().