CVE-2026-64447 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
staging: media: ipu7: fix double-free and use-after-free in error paths
In both ipu7_isys_init() and ipu7_psys_init(), pdata is allocated and then passed to ipu7_bus_initialize_device(), which stores it in adev->pdata. The ipu7_bus_release() function frees adev->pdata when the device's reference count drops to zero.
Two error paths incorrectly call kfree(pdata) after the device teardown has already freed it:
1. When ipu7_mmu_init() fails: put_device() is called, which drops the reference count to zero and triggers ipu7_bus_release() -> kfree(pdata). The subsequent kfree(pdata) is a double-free.
2. When ipu7_bus_add_device() fails: it calls auxiliary_device_uninit() internally, which calls put_device() -> ipu7_bus_release() -> kfree(pdata). The subsequent kfree(pdata) is again a double-free.
Note that the kfree(pdata) when ipu7_bus_initialize_device() itself fails is correct, because in that case auxiliary_device_init() failed and the release function was never set up, so pdata must be freed manually.
Additionally, the error code was not saved before calling put_device(), causing ERR_CAST() to dereference the already-freed adev pointer when constructing the return value. Fix this by saving the error from dev_err_probe() before put_device() and returning ERR_PTR() instead.
Remove the redundant kfree(pdata) calls and fix the use-after-free in the return values of the two affected error paths.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability identified in the Linux kernel's staging media ipu7 driver represents a critical double-free and use-after-free condition that can lead to system instability and potential privilege escalation. This issue affects the initialization functions ipu7_isys_init() and ipu7_psys_init() where device data structures are allocated and subsequently managed through the auxiliary device framework. The problem manifests when error paths execute after device setup failures, creating scenarios where memory management operations conflict with existing cleanup routines.
The technical flaw stems from improper handling of device data structure lifecycle management within the driver's initialization sequence. When ipu7_mmu_init() or ipu7_bus_add_device() functions fail, the code executes put_device() calls that trigger the automatic cleanup path through ipu7_bus_release(). This function correctly frees the pdata pointer stored in adev->pdata when the device reference count reaches zero. However, the error handling code then attempts to manually free the same memory location with additional kfree(pdata) calls, resulting in double-free conditions that can corrupt kernel memory structures and potentially allow attackers to execute arbitrary code.
The vulnerability specifically impacts the Linux kernel's auxiliary device framework implementation and demonstrates a classic memory safety issue where resource cleanup operations are not properly synchronized with error handling paths. The use-after-free condition occurs because error codes are not preserved before put_device() execution, causing ERR_CAST() to attempt dereferencing an already-freed device structure pointer when constructing return values. This represents a fundamental flaw in the driver's error propagation mechanism that can lead to kernel crashes or security exploits.
According to CWE classification, this vulnerability maps to CWE-415: Double Free and CWE-416: Use After Free, both of which are well-documented memory safety issues that frequently appear in kernel drivers. The ATT&CK framework would categorize this under T1068: Exploitation for Privilege Escalation and T1547.001: Registry Run Keys / Startup Folder, as successful exploitation could potentially lead to persistent kernel-level access.
The recommended mitigation involves removing the redundant kfree(pdata) calls that occur after put_device() has already triggered the automatic cleanup process. Additionally, proper error code preservation must be implemented before device release operations to prevent use-after-free conditions in return value construction. The fix ensures that when ipu7_bus_initialize_device() itself fails, manual cleanup occurs correctly since the release function was never properly registered, while avoiding double-free scenarios during error path execution.
This vulnerability highlights the importance of careful resource management in kernel drivers and demonstrates how seemingly minor issues in error handling can create significant security risks. The fix addresses not only the immediate memory safety concerns but also improves the overall robustness of the driver's initialization sequence by ensuring proper cleanup ordering and error propagation. System administrators should prioritize applying this kernel patch to prevent potential exploitation through privilege escalation attacks that could compromise system integrity and confidentiality.