CVE-2026-64447

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ipu7 media staging component where double-free and use-after-free conditions occur during error handling. In the functions ipu7 isys init() and ipu7 psys init(), the pdata variable is allocated and stored in adev->pdata. A double-free occurs in two scenarios: when ipu7 mmu init() fails or when ipu7 bus add device() fails, as both paths trigger ipu7 bus release() to free pdata before a subsequent redundant call to kfree(pdata) is made. Additionally, a use-after-free occurs because the error code is not saved before calling put device(), leading ERR CAST() to dereference the already-freed adev pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.