UBUNTU-CVE-2026-89522: Use After Free
In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isysregisterdevices() registers the V4L2 async notifier via isysnotifierinit(). If a subsequent probe step such as isysfwloginit() fails, isysprobe() jumps to the outcleanup label which only calls isysunregisterdevices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier. As a result the notifier stays chained in the global notifierlist while the enclosing struct ipu7isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked. The remove path already does the right thing by calling isysnotifiercleanup() before isysunregisterdevices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
On the isys_probe() error path, call isys_notifier_cleanup() before isys_unregister_devices() so the async notifier is unregistered and cleaned up before the enclosing struct ipu7_isys is torn down.
Event History
Frequently Asked Questions
Is this issue exposed to remote attackers?
The CVSS vector lists local attack access (AV:L), so the provided data indicates an attacker needs local access rather than network-only reachability.
What level of access does an attacker need?
The CVSS vector specifies low privileges required (PR:L) and no user interaction (UI:N).
Which Ubuntu kernel package variants are listed for this vulnerability?
The listed variants are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.