UBUNTU-CVE-2026-64421: Use After Free
In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in mediaentityremovelink() during rmmod of imx8isi: BUG: KASAN: slab-use-after-free in mediaentityremovelink+0x608/0x650 Read of size 2 at addr ffff0000d47cb02a by task rmmod/724 Call trace: mediaentityremovelink+0x608/0x650 mediaentityremovelinks+0x78/0x144 mediadeviceunregisterentity+0x150/0x280 mediadeviceunregisterentity+0x48/0x68 v4l2deviceunregistersubdev+0x158/0x300 v4l2asyncunbindsubdevone+0x22c/0x358 v4l2asyncnfunbindallsubdevs+0xfc/0x1c0 v4l2asyncnfunregister+0x5c/0x14c mxcisiremove+0x124/0x2a0 [imx8isi] Allocated by task 249: kmallocnoprof+0x27c/0x690 mxcisicrossbarinit+0x22c/0x560 [imx8isi] Freed by task 724: kfree+0x1e4/0x5b0 mxcisicrossbarcleanup+0x34/0x80 [imx8isi] mxcisiremove+0x11c/0x2a0 [imx8isi] The problem is that mxcisiremove() calls mxcisicrossbarcleanup() before mxcisiv4l2cleanup(). The crossbar cleanup frees the media entity pads, but the subsequent v4l2 cleanup still tries to remove media links that reference those pads. Fix this by calling mxcisiv4l2cleanup() before mxcisicrossbarcleanup() to ensure all media entities are properly unregistered while the pads are still valid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-147.147 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70 - Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1012.12~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1069.76 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1066.74 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1052.56 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-31.31~24.04.1 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1067.68 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-147.147.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1064.67 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-31.31.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1033.38 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1062.63 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-147.147+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-31.31 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1012.12 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1011.11 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1006.7 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1011.11 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-31.31.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-31.31.1 - Compensating control
In mxc_isi_remove(), call mxc_isi_v4l2_cleanup() before mxc_isi_crossbar_cleanup() so media entities are unregistered while their pads remain valid.
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems running an affected Ubuntu kernel package listed in the advisory are exposed when the imx8_isi media driver is present and removed. The failure occurs during removal of the imx8_isi module, involving its media-device and V4L2 cleanup paths.
What conditions are needed to trigger the vulnerability?
An attacker or local user needs local access with sufficient privileges to cause the imx8_isi driver to be removed, such as unloading the module. The reported crash occurs during rmmod after crossbar cleanup frees media entity pads before V4L2 cleanup removes links referencing them.
What is the impact if the issue is triggered?
The flaw is a use-after-free in media-link removal, with high confidentiality, integrity, and availability impact in the supplied severity vector. It can cause a kernel memory safety failure during driver removal.
How can I identify whether a system has encountered this problem?
Look for KASAN reports of slab-use-after-free in __media_entity_remove_link during removal of imx8_isi. Relevant call traces include mxc_isi_crossbar_cleanup followed by mxc_isi_v4l2_cleanup from mxc_isi_remove.