CVE-2026-89522

CVE CVE-2026-89522EUVD EUVD-2026-76428Published 2026-09-11T19:44:04.000ZLast changed 2026-09-13T06:30:21.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys_register_devices() registers the V4L2 async notifier via isys_notifier_init(). If a subsequent probe step such as isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label which only calls isys_unregister_devices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier. As a result the notifier stays chained in the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked. The remove path already does the right thing by calling isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 7.3-rc1; 6.17; a516d36bdc3d8373f904af57c95e76d6f921cf1c <2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81; a516d36bdc3d8373f904af57c95e76d6f921cf1c <d7f48aa7d60c65d3e6d5312c27f17d5525a245fb; a516d36bdc3d8373f904af57c95e76d6f921cf1c <323c411fb63122e8cef5b833032d69d59a838559; patch: 6.18.50; patch: 0; patch: 7.2.4

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.