CVE-2026-89886 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
media: intel/ipu6: fix async notifier cleanup leak on parse error
isys_notifier_init() calls v4l2_async_nf_init() and then adds fwnode remote subdevs in a loop with v4l2_async_nf_add_fwnode_remote(). If an endpoint parse or add fails partway through the loop, it jumps to err_parse and returns without calling v4l2_async_nf_cleanup(), leaking every v4l2_async_connection already added to the notifier's waiting list.
The register-failure path just below already cleans up correctly, and the caller only tears the notifier down (isys_notifier_cleanup()) once isys_notifier_init() has returned success. Clean up the notifier on the parse error path too.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in the Linux kernel media subsystem specifically affects the Intel IPU6 driver through a resource leak within its asynchronous notification framework initialization process. The core of this issue resides in the isys_notifier_init function, which serves as the primary entry point for setting up hardware notifications required for device operation. During execution, this routine invokes v4l2_async_nf_init to establish the notifier structure and subsequently iterates through firmware node remote subdevs using v4l2_async_nf_add_fwnode_remote. This loop is critical for mapping physical connections between components in complex multimedia pipelines. However, a logical flaw exists in the error handling path associated with this iteration. If an endpoint parsing operation or the addition of a specific subdev fails midway through the sequence, control flow diverts to an err_parse label that returns immediately without invoking v4l2_async_nf_cleanup. This omission results in every v4l2_async_connection structure previously allocated and added to the notifier's waiting list remaining uncollected, creating a persistent memory leak within kernel space.
From a technical perspective, this flaw represents a classic resource management error where cleanup routines are not uniformly applied across all exit paths of a function. The existing code correctly handles registration failures in subsequent blocks by ensuring proper teardown, and the caller is designed to invoke isys_notifier_cleanup only upon successful initialization. This architectural assumption highlights that the responsibility for cleaning up partial initializations was incorrectly placed on the caller rather than being contained within the initializer itself when early termination occurs due to parsing errors. The consequence of this oversight is a gradual accumulation of unreleased memory structures in kernel space, which can lead to increased resource consumption over time or during repeated initialization attempts, potentially contributing to system instability if left unaddressed in long-running systems or environments with frequent device reconfiguration.
The operational impact of this vulnerability extends beyond simple memory waste. In the context of multimedia drivers, such leaks can degrade performance by consuming kernel heap resources that are critical for other subsystems. Over time, these unreleased v4l2_async_connection objects reduce the available pool for new hardware connections, potentially causing subsequent device registrations to fail due to resource exhaustion or internal state corruption within the notifier framework. This aligns with CWE-401, which describes a missing release of memory after effective usage, and falls under the broader category of improper resource cleanup that can lead to denial-of-service conditions through resource depletion. The vulnerability is particularly relevant in systems where media devices are frequently hot-plugged or reconfigured, as each failed initialization attempt would incrementally increase the leak magnitude.
To mitigate this risk, the resolution involves modifying the error handling logic within isys_notifier_init to ensure that v4l2_async_nf_cleanup is called whenever an endpoint parse or add operation fails before returning an error code. This ensures symmetry between resource allocation and deallocation across all execution paths. Security practitioners and system administrators should verify that their kernel versions include this specific fix for the Intel IPU6 driver. Additionally, implementing robust memory debugging tools such as KASAN in development environments can help detect similar patterns of missing cleanup calls in other parts of the media subsystem or related drivers. Regular auditing of error handling paths in complex initialization routines is essential to prevent these types of resource leaks from accumulating and impacting system reliability.