GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89522 (GCVE-0-2026-89522)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:30
VLAI
Title
media: staging/ipu7: fix async notifier UAF on probe error path
Summary
In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys_register_devices() registers the V4L2 async notifier via isys_notifier_init(). If a subsequent probe step such as isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label which only calls isys_unregister_devices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier. As a result the notifier stays chained in the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked. The remove path already does the right thing by calling isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a516d36bdc3d8373f904af57c95e76d6f921cf1c , < 2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81 (git)
Affected: a516d36bdc3d8373f904af57c95e76d6f921cf1c , < 323c411fb63122e8cef5b833032d69d59a838559 (git)
Affected: a516d36bdc3d8373f904af57c95e76d6f921cf1c , < d7f48aa7d60c65d3e6d5312c27f17d5525a245fb (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/ipu7/ipu7-isys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81",
              "status": "affected",
              "version": "a516d36bdc3d8373f904af57c95e76d6f921cf1c",
              "versionType": "git"
            },
            {
              "lessThan": "323c411fb63122e8cef5b833032d69d59a838559",
              "status": "affected",
              "version": "a516d36bdc3d8373f904af57c95e76d6f921cf1c",
              "versionType": "git"
            },
            {
              "lessThan": "d7f48aa7d60c65d3e6d5312c27f17d5525a245fb",
              "status": "affected",
              "version": "a516d36bdc3d8373f904af57c95e76d6f921cf1c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/ipu7/ipu7-isys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: staging/ipu7: fix async notifier UAF on probe error path\n\nisys_register_devices() registers the V4L2 async notifier via\nisys_notifier_init(). If a subsequent probe step such as\nisys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label\nwhich only calls isys_unregister_devices(). That helper tears down the\nvideo devices, subdevices, V4L2 device and media device, but never\nunregisters or cleans up the async notifier.\n\nAs a result the notifier stays chained in the global notifier_list while\nthe enclosing struct ipu7_isys is freed by devres, leading to list\ncorruption and a use-after-free the next time the list is walked.\n\nThe remove path already does the right thing by calling\nisys_notifier_cleanup() before isys_unregister_devices(). Mirror that on\nthe probe error path so the notifier is unregistered and cleaned up\nbefore the device is torn down."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in isys_probe() of the Intel IPU7 ISYS auxiliary driver (PCI IDs 0x645d/0xb05d on Meteor Lake/Arrow Lake/Lunar Lake laptops). It is reached only via local driver bind of the onboard MIPI camera ISP, not via network packets, Bluetooth, or USB attachment.\nAC:L - The missing isys_notifier_cleanup() on the out_cleanup path is deterministic. A local attacker can force the subsequent 2 MiB FW_LOG_BUF_SIZE kzalloc in isys_fw_log_init() to fail under memory pressure, and the UAF is then hit the next time notifier_list is walked, with no race the attacker must win.\nPR:L - After probe failure leaves the notifier on the global notifier_list, ACPI camera sensors typical of IPU7 laptops (ov02c10, ov08x40, and similar) call v4l2_async_register_subdev_sensor() and walk that list without capabilities. Per CNA guidance, Low is used when probe/bind privilege gating is ambiguous.\nUI:N - No victim action such as opening /dev/video*, mounting a filesystem, or plugging a device is required. The dangling notifier is planted on the probe error path and consumed automatically when a sensor or other V4L2 async client registers.\nS:U - Impact is host-kernel slab use-after-free and list corruption inside the IPU7/V4L2 async core. This is standard kernel privilege-escalation territory and does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - The notifier is embedded in struct ipu7_isys, which devres frees while it remains linked on notifier_list. A later walk reads freed notifier fields and ops; per kernel CNA UAF guidance that reuse primitive enables arbitrary kernel memory disclosure.\nI:H - Walking or unlinking the dangling notifier_entry corrupts kernel lists, and a reclaimed object can redirect notifier-\u003eops (bound/complete) to attacker-controlled function pointers, yielding an arbitrary-write and control-flow hijack primitive.\nA:H - The next notifier_list walk or bound callback on the freed ipu7_isys object causes a kernel oops or panic, and use-after-free heap corruption inherently denies availability even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:21.016Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81"
        },
        {
          "url": "https://git.kernel.org/stable/c/323c411fb63122e8cef5b833032d69d59a838559"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7f48aa7d60c65d3e6d5312c27f17d5525a245fb"
        }
      ],
      "title": "media: staging/ipu7: fix async notifier UAF on probe error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89522",
    "datePublished": "2026-09-11T19:44:04.052Z",
    "dateReserved": "2026-09-11T19:38:34.718Z",
    "dateUpdated": "2026-09-13T06:30:21.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89522",
      "date": "2026-09-17",
      "epss": "0.00133",
      "percentile": "0.03179"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89522\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:34.890\",\"lastModified\":\"2026-09-13T07:17:14.573\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: staging/ipu7: fix async notifier UAF on probe error path\\n\\nisys_register_devices() registers the V4L2 async notifier via\\nisys_notifier_init(). If a subsequent probe step such as\\nisys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label\\nwhich only calls isys_unregister_devices(). That helper tears down the\\nvideo devices, subdevices, V4L2 device and media device, but never\\nunregisters or cleans up the async notifier.\\n\\nAs a result the notifier stays chained in the global notifier_list while\\nthe enclosing struct ipu7_isys is freed by devres, leading to list\\ncorruption and a use-after-free the next time the list is walked.\\n\\nThe remove path already does the right thing by calling\\nisys_notifier_cleanup() before isys_unregister_devices(). Mirror that on\\nthe probe error path so the notifier is unregistered and cleaned up\\nbefore the device is torn down.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/staging/media/ipu7/ipu7-isys.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a516d36bdc3d8373f904af57c95e76d6f921cf1c\",\"lessThan\":\"2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a516d36bdc3d8373f904af57c95e76d6f921cf1c\",\"lessThan\":\"323c411fb63122e8cef5b833032d69d59a838559\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a516d36bdc3d8373f904af57c95e76d6f921cf1c\",\"lessThan\":\"d7f48aa7d60c65d3e6d5312c27f17d5525a245fb\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/staging/media/ipu7/ipu7-isys.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/323c411fb63122e8cef5b833032d69d59a838559\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d7f48aa7d60c65d3e6d5312c27f17d5525a245fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T06:52:15+00:00",
      "cve": "CVE-2026-89522",
      "id": "CVE-2026-89522",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: staging/ipu7: fix async notifier UAF on probe error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89522.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:02:19Z",
      "cve": "CVE-2026-89522",
      "id": "CVE-2026-89522",
      "initial_release_date": "2026-09-12T16:26:55Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89522",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89522.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.