UBUNTU-CVE-2026-93070: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Do not free aux device pdata after init ipu6businitializedevice() stores the isys/psys pdata pointer in struct ipu6busdevice and initializes the auxiliary device. After that point, error unwinding must drop the auxiliary device reference and let ipu6busrelease() free both the bus device and adev->pdata. The isys and psys init paths already call putdevice() when MMU initialization fails, and ipu6busadddevice() calls auxiliarydeviceuninit() on auxiliarydeviceadd() failure. Both paths therefore run the bus release callback. The extra kfree(pdata) in the callers can release the same object a second time. Remove the manual pdata frees after the auxiliary device has been initialized. This issue was found by a static analysis checker and confirmed by manual source review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Remove the manual kfree(pdata) calls from the isys and psys initialization callers after ipu6_bus_initialize_device() has initialized the auxiliary device; let error unwinding drop the auxiliary device reference and let ipu6_bus_release() free both the bus device and adev->pdata.