CVE-2026-89522: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys_register_devices() registers the V4L2 async notifier via isys_notifier_init(). If a subsequent probe step such as isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label which only calls isys_unregister_devices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier. As a result the notifier stays chained in the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked. The remove path already does the right thing by calling isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down.

Засегнати продукти

• Linux Linux: a516d36bdc3d8373f904af57c95e76d6f921cf1c преди 2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81; a516d36bdc3d8373f904af57c95e76d6f921cf1c преди 323c411fb63122e8cef5b833032d69d59a838559; a516d36bdc3d8373f904af57c95e76d6f921cf1c преди d7f48aa7d60c65d3e6d5312c27f17d5525a245fb
• Linux Linux: 6.17; преди 6.17; 6.18.50 до 6.18.*; 7.2.4 до 7.2.*; 7.3 до *

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99268
• CVE-2026-99266
• CVE-2026-99267

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-89522
• https://nvd.nist.gov/vuln/detail/CVE-2026-89522
• https://git.kernel.org/stable/c/2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81
• https://git.kernel.org/stable/c/323c411fb63122e8cef5b833032d69d59a838559
• https://git.kernel.org/stable/c/d7f48aa7d60c65d3e6d5312c27f17d5525a245fb