CVE-2026-80650

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the gc2235 probe() function where error paths are handled incorrectly. If media entity pads init() fails, the system calls gc2235 remove(), which frees the dev variable and tears down the subdev, but subsequently continues to atomisp register i2c module(), leading to a use-after-free (a situation where a program continues to use a pointer after it has been freed). Additionally, if atomisp register i2c module() fails, the dev variable is leaked, and the media entity and control handler remain initialized. The gc2235 remove() function also calls media entity cleanup() and v4l2 ctrl handler free() unconditionally, even if they were not initialized during the probe process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.