CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's media subsystem, specifically during the device probe error handling in the IPU7 driver. If a probe step fails, it can lead to a use-after-free condition due to the async notifier remaining registered while its associated structure is freed, potentially resulting in memory corruption. System administrators and developers managing Linux-based systems with the affected kernel should prioritize applying the fix to mitigate potential exploitation risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys_register_devices() registers the V4L2 async notifier via isys_notifier_init(). If a subsequent probe step such as isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label which only calls isys_unregister_devices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier. As a result the notifier stays chained in the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked. The remove path already does the right thing by calling isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down.