CVE-2026-93070
Description
In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Do not free aux device pdata after init ipu6_bus_initialize_device() stores the isys/psys pdata pointer in struct ipu6_bus_device and initializes the auxiliary device. After that point, error unwinding must drop the auxiliary device reference and let ipu6_bus_release() free both the bus device and adev->pdata. The isys and psys init paths already call put_device() when MMU initialization fails, and ipu6_bus_add_device() calls auxiliary_device_uninit() on auxiliary_device_add() failure. Both paths therefore run the bus release callback. The extra kfree(pdata) in the callers can release the same object a second time. Remove the manual pdata frees after the auxiliary device has been initialized. This issue was found by a static analysis checker and confirmed by manual source review.
How to fix
- Linux Linuxfaa1eb97f0e66bf122f44b62be6b323f86333e9f, 5323ed5a7bb2568191ec676b2035b0396105aa05, 7d102d1f0631807a491a140f67c9628dea85dfd2, 9be07216af4cfc4813e1a46ce26407d31ea845de or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | cb3117b074aefb0320d8d728a0a7f277a121adbd ≤ v < faa1eb97f0e66bf122f44b62be6b323f86333e9f, cb3117b074aefb0320d8d728a0a7f277a121adbd ≤ v < 5323ed5a7bb2568191ec676b2035b0396105aa05, cb3117b074aefb0320d8d728a0a7f277a121adbd ≤ v < 7d102d1f0631807a491a140f67c9628dea85dfd2, cb3117b074aefb0320d8d728a0a7f277a121adbd ≤ v < 9be07216af4cfc4813e1a46ce26407d31ea845de, 6.10 | faa1eb97f0e66bf122f44b62be6b323f86333e9f, 5323ed5a7bb2568191ec676b2035b0396105aa05, 7d102d1f0631807a491a140f67c9628dea85dfd2, 9be07216af4cfc4813e1a46ce26407d31ea845de |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.