Skip to main content

Linux Kernel CVE-2026-64421

| EUVDEUVD-2026-48965 HIGH
Use After Free (CWE-416)
2026-07-25 Linux GHSA-jj8q-g7xc-jx6p
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

Triggering rmmod requires CAP_SYS_MODULE (PR:H); reliable UAF exploitation requires heap spray timing, raising complexity to AC:H.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Sep 04, 2026 - 17:37 vuln.today
CVSS changed
Sep 04, 2026 - 15:22 NVD
7.8 (HIGH)
CVE Published
Jul 25, 2026 - 08:50 nvd
HIGH 7.8
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

media: nxp: imx8-isi: Fix use-after-free on remove

KASAN reports a slab-use-after-free in __media_entity_remove_link() during rmmod of imx8_isi:

BUG: KASAN: slab-use-after-free in __media_entity_remove_link+0x608/0x650 Read of size 2 at addr ffff0000d47cb02a by task rmmod/724

Call trace: __media_entity_remove_link+0x608/0x650 __media_entity_remove_links+0x78/0x144 __media_device_unregister_entity+0x150/0x280 media_device_unregister_entity+0x48/0x68 v4l2_device_unregister_subdev+0x158/0x300 v4l2_async_unbind_subdev_one+0x22c/0x358 v4l2_async_nf_unbind_all_subdevs+0xfc/0x1c0 v4l2_async_nf_unregister+0x5c/0x14c mxc_isi_remove+0x124/0x2a0 [imx8_isi]

Allocated by task 249: __kmalloc_noprof+0x27c/0x690 mxc_isi_crossbar_init+0x22c/0x560 [imx8_isi]

Freed by task 724: kfree+0x1e4/0x5b0 mxc_isi_crossbar_cleanup+0x34/0x80 [imx8_isi] mxc_isi_remove+0x11c/0x2a0 [imx8_isi]

The problem is that mxc_isi_remove() calls mxc_isi_crossbar_cleanup() before mxc_isi_v4l2_cleanup(). The crossbar cleanup frees the media entity pads, but the subsequent v4l2 cleanup still tries to remove media links that reference those pads.

Fix this by calling mxc_isi_v4l2_cleanup() before mxc_isi_crossbar_cleanup() to ensure all media entities are properly unregistered while the pads are still valid.

AnalysisAI

Use-after-free memory corruption in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver is triggered during module removal (rmmod of imx8_isi), confirmed by KASAN slab-use-after-free reports. The root cause is an incorrect teardown order in mxc_isi_remove(): the crossbar cleanup frees media entity pads before the V4L2 cleanup has finished removing media links that reference those same pads, resulting in a dangling pointer dereference in __media_entity_remove_link(). No public exploit has been identified at time of analysis, and with EPSS at 0.21% (11th percentile), real-world weaponization appears unlikely despite the CVSS 7.8 score.

Technical ContextAI

The vulnerability resides in the NXP i.MX8 Image Sensing Interface (ISI) driver within the Linux kernel's media subsystem (drivers/media/platform/nxp/imx8-isi/). The ISI driver implements a V4L2 crossbar entity with dynamically allocated pad structures. During module unload, mxc_isi_remove() incorrectly calls mxc_isi_crossbar_cleanup() first - freeing the pad array via kfree() - before calling mxc_isi_v4l2_cleanup(), which attempts to traverse and remove media links that still hold pointers to those now-freed pads. This triggers a classic CWE-416 (Use After Free) when __media_entity_remove_link() reads from the freed memory region. The CPE data identifies this as the Linux kernel generically; in practice the vulnerable code path only activates on hardware platforms featuring the NXP i.MX8 SoC and its ISI peripheral.

RemediationAI

The fix reverses the teardown order in mxc_isi_remove() so that mxc_isi_v4l2_cleanup() is called before mxc_isi_crossbar_cleanup(), ensuring all media link references are removed while pads remain valid. Update to a patched kernel version: 6.6.145 or later for the 6.6 LTS branch, 6.12.97 or later for the 6.12 LTS branch, 6.18.40 or later for the 6.18 branch, or 7.1.4 / 7.2-rc1 and later for mainline. Patch commits are indexed at git.kernel.org/stable (see references). As a compensating control on systems where a kernel update is not immediately feasible, administrators can blacklist or prevent automatic loading of the imx8_isi module (e.g., via /etc/modprobe.d/blacklist.conf) if the ISI camera pipeline is not required; this eliminates the vulnerable code path entirely but disables NXP i.MX8 ISI camera functionality. No vendor advisory URL beyond the NVD entry and upstream kernel stable commits has been identified.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

CVE-2026-64421 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy