CVE-2026-93070

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double-free issue exists in the ipu6 media component. The function ipu6 bus initialize device() stores the isys/psys pdata pointer in struct ipu6 bus device and initializes the auxiliary device. During error unwinding, the isys and psys initialization paths call put device() upon MMU initialization failure, and ipu6 bus add device() calls auxiliary device uninit() if auxiliary device add() fails. Both scenarios trigger the bus release callback, which frees the bus device and adev->pdata. If the caller also performs a manual kfree(pdata), the same object is released a second time.

Recommendations Remove manual pdata frees after the auxiliary device has been initialized.