CVE-2026-93070: media: ipu6: Do not free aux device pdata after init
In the Linux kernel, the following vulnerability has been resolved:
media: ipu6: Do not free aux device pdata after init
ipu6businitializedevice() stores the isys/psys pdata pointer in struct ipu6busdevice and initializes the auxiliary device. After that point, error unwinding must drop the auxiliary device reference and let ipu6busrelease() free both the bus device and adev->pdata.
The isys and psys init paths already call putdevice() when MMU initialization fails, and ipu6busadddevice() calls auxiliarydeviceuninit() on auxiliarydeviceadd() failure. Both paths therefore run the bus release callback. The extra kfree(pdata) in the callers can release the same object a second time.
Remove the manual pdata frees after the auxiliary device has been initialized.
This issue was found by a static analysis checker and confirmed by manual source review.
Affected Software
Event History
Frequently Asked Questions
Under what conditions can the double free occur?
It can occur on error-unwinding paths after the auxiliary device has been initialized. The described paths are MMU initialization failure in the isys or psys initialization flows, and auxiliary_device_add() failure in ipu6_bus_add_device().
Which systems or components are exposed?
The affected code is in the Linux kernel IPU6 media driver, specifically its isys and psys device-initialization paths. Exposure requires one of the described post-initialization error paths to be reached.
What is the relevant remediation behavior?
After auxiliary-device initialization, the caller should release the auxiliary device reference or uninitialize it as appropriate and allow ipu6_bus_release() to free the bus device and pdata. Callers must not separately free pdata after that point.