EUVD-2026-76428
GHSA-p4hr-jw27-vj7c
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local UAF in kernel driver with deterministic error-path trigger; low privileges suffice to load modules; full kernel C/I/A impact if exploited.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
media: staging/ipu7: fix async notifier UAF on probe error path
isys_register_devices() registers the V4L2 async notifier via isys_notifier_init(). If a subsequent probe step such as isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label which only calls isys_unregister_devices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier.
As a result the notifier stays chained in the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked.
The remove path already does the right thing by calling isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down.
AnalysisAI
Use-after-free in the Linux kernel's staging Intel IPU7 media driver allows a local attacker to corrupt kernel memory and potentially escalate privileges. The isys_probe() error path registers the V4L2 async notifier but fails to unregister it on subsequent probe failures, leaving a dangling pointer in the global notifier_list after devres frees the enclosing struct ipu7_isys. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) Intel IPU7 hardware physically present in the target system (currently limited to Intel Lunar Lake and similar SoC platforms); (2) the staging `ipu7-isys` kernel module loaded or built-in; (3) the module probe must fail at a specific intermediate stage - after `isys_notifier_init()` succeeds but before `isys_probe()` completes - leaving the notifier registered but the device being freed; (4) a subsequent kernel event that walks the global V4L2 `notifier_list` (triggered by media subsystem activity, hotplug events, or another driver registration). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is meaningfully lower than the CVSS 7.8 score implies in isolation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available for stable kernel branches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux systems with Intel IPU7 hardware to identify affected devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today