CVE-2026-64447

CVE CVE-2026-64447EUVD EUVD-2026-48791Published 2026-07-25T08:51:18.000ZLast changed 2026-08-05T12:42:10.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7_isys_init() and ipu7_psys_init(), pdata is allocated and then passed to ipu7_bus_initialize_device(), which stores it in adev->pdata. The ipu7_bus_release() function frees adev->pdata when the device's reference count drops to zero. Two error paths incorrectly call kfree(pdata) after the device teardown has already freed it: 1. When ipu7_mmu_init() fails: put_device() is called, which drops the reference count to zero and triggers ipu7_bus_release() -> kfree(pdata). The subsequent kfree(pdata) is a double-free. 2. When ipu7_bus_add_device() fails: it calls auxiliary_device_uninit() internally, which calls put_device() -> ipu7_bus_release() -> kfree(pdata). The subsequent kfree(pdata) is again a double-free. Note that the kfree(pdata) when ipu7_bus_initialize_device() itself fails is correct, because in that case auxiliary_device_init() failed and the release function was never set up, so pdata must be freed manually. Additionally, the error code was not saved before calling put_device(), causing ERR_CAST() to dereference the already-freed adev pointer when constructing the return value. Fix this by saving the error from dev_err_probe() before put_device() and returning ERR_PTR() instead. Remove the redundant kfree(pdata) calls and fix the use-after-free in the return values of the two affected error paths.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5 <837c1f9655421055f751ed34745e820a54a27642; patch: 7.2-rc1; b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5 <d3a9a8cf2d7fd61a2f63df61f6cbc0a9bb007cc0; patch: 0; 6.17; patch: 6.18.39; b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5 <b5ddc7257bee71f5b8cf9083e2b0ac0427e9fbb3; patch: 7.1.4

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.