CVE-2026-64447

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

staging: media: ipu7: fix double-free and use-after-free in error paths

In both ipu7_isys_init() and ipu7_psys_init(), pdata is allocated and

then passed to ipu7_bus_initialize_device(), which stores it in

adev->pdata. The ipu7_bus_release() function frees adev->pdata when the

device's reference count drops to zero.

Two error paths incorrectly call kfree(pdata) after the device teardown

has already freed it:

1. When ipu7_mmu_init() fails: put_device() is called, which drops the

reference count to zero and triggers ipu7_bus_release() ->

kfree(pdata). The subsequent kfree(pdata) is a double-free.

2. When ipu7_bus_add_device() fails: it calls auxiliary_device_uninit()

internally, which calls put_device() -> ipu7_bus_release() ->

kfree(pdata). The subsequent kfree(pdata) is again a double-free.

Note that the kfree(pdata) when ipu7_bus_initialize_device() itself

fails is correct, because in that case auxil

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References