CVE-2026-89522 (GCVE-0-2026-89522)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-10-19 08:48
VLAI
Title
media: staging/ipu7: fix async notifier UAF on probe error path
Summary
In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys_register_devices() registers the V4L2 async notifier via isys_notifier_init(). If a subsequent probe step such as isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label which only calls isys_unregister_devices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier. As a result the notifier stays chained in the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked. The remove path already does the right thing by calling isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6639 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a516d36bdc3d8373f904af57c95e76d6f921cf1c , < 2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81 (git)
Affected: a516d36bdc3d8373f904af57c95e76d6f921cf1c , < 323c411fb63122e8cef5b833032d69d59a838559 (git)
Affected: a516d36bdc3d8373f904af57c95e76d6f921cf1c , < d7f48aa7d60c65d3e6d5312c27f17d5525a245fb (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/ipu7/ipu7-isys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81",
              "status": "affected",
              "version": "a516d36bdc3d8373f904af57c95e76d6f921cf1c",
              "versionType": "git"
            },
            {
              "lessThan": "323c411fb63122e8cef5b833032d69d59a838559",
              "status": "affected",
              "version": "a516d36bdc3d8373f904af57c95e76d6f921cf1c",
              "versionType": "git"
            },
            {
              "lessThan": "d7f48aa7d60c65d3e6d5312c27f17d5525a245fb",
              "status": "affected",
              "version": "a516d36bdc3d8373f904af57c95e76d6f921cf1c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/ipu7/ipu7-isys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: staging/ipu7: fix async notifier UAF on probe error path\n\nisys_register_devices() registers the V4L2 async notifier via\nisys_notifier_init(). If a subsequent probe step such as\nisys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label\nwhich only calls isys_unregister_devices(). That helper tears down the\nvideo devices, subdevices, V4L2 device and media device, but never\nunregisters or cleans up the async notifier.\n\nAs a result the notifier stays chained in the global notifier_list while\nthe enclosing struct ipu7_isys is freed by devres, leading to list\ncorruption and a use-after-free the next time the list is walked.\n\nThe remove path already does the right thing by calling\nisys_notifier_cleanup() before isys_unregister_devices(). Mirror that on\nthe probe error path so the notifier is unregistered and cleaned up\nbefore the device is torn down."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in isys_probe() of the Intel IPU7 ISYS auxiliary driver (PCI IDs 0x645d/0xb05d on Meteor Lake/Arrow Lake/Lunar Lake laptops). It is reached only via local driver bind of the onboard MIPI camera ISP, not via network packets, Bluetooth, or USB attachment.\nAC:L - The missing isys_notifier_cleanup() on the out_cleanup path is deterministic. A local attacker can force the subsequent 2 MiB FW_LOG_BUF_SIZE kzalloc in isys_fw_log_init() to fail under memory pressure, and the UAF is then hit the next time notifier_list is walked, with no race the attacker must win.\nPR:L - After probe failure leaves the notifier on the global notifier_list, ACPI camera sensors typical of IPU7 laptops (ov02c10, ov08x40, and similar) call v4l2_async_register_subdev_sensor() and walk that list without capabilities. Per CNA guidance, Low is used when probe/bind privilege gating is ambiguous.\nUI:N - No victim action such as opening /dev/video*, mounting a filesystem, or plugging a device is required. The dangling notifier is planted on the probe error path and consumed automatically when a sensor or other V4L2 async client registers.\nS:U - Impact is host-kernel slab use-after-free and list corruption inside the IPU7/V4L2 async core. This is standard kernel privilege-escalation territory and does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - The notifier is embedded in struct ipu7_isys, which devres frees while it remains linked on notifier_list. A later walk reads freed notifier fields and ops; per kernel CNA UAF guidance that reuse primitive enables arbitrary kernel memory disclosure.\nI:H - Walking or unlinking the dangling notifier_entry corrupts kernel lists, and a reclaimed object can redirect notifier-\u003eops (bound/complete) to attacker-controlled function pointers, yielding an arbitrary-write and control-flow hijack primitive.\nA:H - The next notifier_list walk or bound callback on the freed ipu7_isys object causes a kernel oops or panic, and use-after-free heap corruption inherently denies availability even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:48:13.544Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81"
        },
        {
          "url": "https://git.kernel.org/stable/c/323c411fb63122e8cef5b833032d69d59a838559"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7f48aa7d60c65d3e6d5312c27f17d5525a245fb"
        }
      ],
      "title": "media: staging/ipu7: fix async notifier UAF on probe error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89522",
    "datePublished": "2026-09-11T19:44:04.052Z",
    "dateReserved": "2026-09-11T19:38:34.718Z",
    "dateUpdated": "2026-10-19T08:48:13.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89522",
      "date": "2026-11-09",
      "epss": "0.00168",
      "percentile": "0.06208"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/media/ipu7/ipu7-isys.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81",
                    "status": "affected",
                    "version": "a516d36bdc3d8373f904af57c95e76d6f921cf1c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "323c411fb63122e8cef5b833032d69d59a838559",
                    "status": "affected",
                    "version": "a516d36bdc3d8373f904af57c95e76d6f921cf1c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d7f48aa7d60c65d3e6d5312c27f17d5525a245fb",
                    "status": "affected",
                    "version": "a516d36bdc3d8373f904af57c95e76d6f921cf1c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/media/ipu7/ipu7-isys.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: staging/ipu7: fix async notifier UAF on probe error path\n\nisys_register_devices() registers the V4L2 async notifier via\nisys_notifier_init(). If a subsequent probe step such as\nisys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label\nwhich only calls isys_unregister_devices(). That helper tears down the\nvideo devices, subdevices, V4L2 device and media device, but never\nunregisters or cleans up the async notifier.\n\nAs a result the notifier stays chained in the global notifier_list while\nthe enclosing struct ipu7_isys is freed by devres, leading to list\ncorruption and a use-after-free the next time the list is walked.\n\nThe remove path already does the right thing by calling\nisys_notifier_cleanup() before isys_unregister_devices(). Mirror that on\nthe probe error path so the notifier is unregistered and cleaned up\nbefore the device is torn down."
          }
        ],
        "id": "CVE-2026-89522",
        "lastModified": "2026-10-19T09:17:46.647",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:34.890",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/323c411fb63122e8cef5b833032d69d59a838559"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d7f48aa7d60c65d3e6d5312c27f17d5525a245fb"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-06T01:17:05+00:00",
      "cve": "CVE-2026-89522",
      "id": "CVE-2026-89522",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "202",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: staging/ipu7: fix async notifier UAF on probe error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89522.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.