media: intel/ipu6: fix async notifier cleanup leak on parse error (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.20 % · percentile 10 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix async notifier cleanup leak on parse error isys_notifier_init() calls v4l2_async_nf_init() and then adds fwnode remote subdevs in a loop with v4l2_async_nf_add_fwnode_remote(). If an endpoint parse or add fails partway through the loop, it jumps to err_parse and returns without calling v4l2_async_nf_cleanup(), leaking every v4l2_async_connection already added to the notifier's waiting list. The register-failure path just below already cleans up correctly, and the caller only tears the notifier down (isys_notifier_cleanup()) once isys_notifier_init() has returned success. Clean up the notifier on the parse error path too.
References
European references
- ENISA EUVD · EUVD-2026-80486
- GCVE · GCVE-0-2026-89886
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected f50c4ca0a82003b8a542c3332fd292cf1bc355a2 < dd5943aedbe4d7eb46158cb35078257733ac48b6 ; affected f50c4ca0a82003b8a542c3332fd292cf1bc355a2 < 27b7997be552ee37b3e01beacfeb4131f1bebb5f ; affected f50c4ca0a82003b8a542c3332fd292cf1bc355a2 < eee6069e4e9511e814a33a75e403f7e863f70394 ; affected f50c4ca0a82003b8a542c3332fd292cf1bc355a2 < abb1f808ceab5a3275f8a6b4e37cff17f9f781c1 |
| Linux · Linux | affected 6.10 ; unaffected 0 < 6.10 ; unaffected 6.12.110 ≤ 6.12.* ; unaffected 6.18.51 ≤ 6.18.* ; unaffected 7.2.5 ≤ 7.2.* ; unaffected 7.3 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |