CVE-2026-93070

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: ipu6: Do not free aux device pdata after init

ipu6_bus_initialize_device() stores the isys/psys pdata pointer in

struct ipu6_bus_device and initializes the auxiliary device. After that

point, error unwinding must drop the auxiliary device reference and let

ipu6_bus_release() free both the bus device and adev->pdata.

The isys and psys init paths already call put_device() when MMU

initialization fails, and ipu6_bus_add_device() calls

auxiliary_device_uninit() on auxiliary_device_add() failure. Both paths

therefore run the bus release callback. The extra kfree(pdata) in the

callers can release the same object a second time.

Remove the manual pdata frees after the auxiliary device has been

initialized.

This issue was found by a static analysis checker and confirmed by

manual source review.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References