HIGH Introduced in 5.8
atomisp Probe UAF
CVE-2026-80650
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: media: atomisp: gc2235: fix UAF and memory leak gc2235_probe() handles its error paths incorrectly. If media_entity_pads_init() fails, gc2235_remove() is called, which tears down the subdev and frees dev, but then still falls through to atomisp_register_i2c_module(). This results in use-after-free. If atomisp_register_i2c_module() fails, the media entity and control handler are left initialized and dev is leaked. gc2235_remove() unconditionally calls media_entity_cleanup() and v4l2_ctrl_handler_free(), but these are not initialized at every error path in gc2235_probe(). Replace gc2235_remove() calls in the probe error paths with explicit unwind labels that free only the resources initialized at each point of failure, in reverse order of initialization.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability exists in the gc2235 camera sensor driver's probe error handling, where a freed device structure is accessed after premature cleanup. This affects systems with Intel IPU v2 hardware and the atomisp staging driver loaded, potentially allowing local privilege escalation or denial of service through kernel memory corruption.
Vulnerability analysis
The camera sensor driver's initialization contains a flaw in its failure recovery: when one setup step fails, the cleanup path frees a device object, but the initialization function continues and passes that freed object to another routine, causing a use-after-free. On other failure paths, some allocated resources are never released, leading to memory leaks. The correction introduces separate, ordered cleanup steps for each failure point so that only resources that were actually initialized are freed. This driver belongs to the Intel IPU v2 camera support and is activated automatically when the system detects the matching hardware and loads the staging module; a local attacker who can cause a failure at the right moment during this setup process could trigger the use-after-free.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 5.8 | 6.12.97 | 592a0e78ab08 |
| 6.18 | 5.8 | 6.18.40 | fdbb8e55578b |
| 6.6 | 5.8 | 6.6.160 | 51b8dc5163d2 |
| 7.1 | 5.8 | 7.1.5 | d57e67ea48e4 |
| mainline | 5.8 | 7.2 | f614bf0a64aa |
| cip/6.12 | 5.8 | 6.12.101-cip29 | fdbb8e55578b |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |