---
id: CVE-2026-89522
title: 'media: staging/ipu7: fix async notifier UAF on probe error path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: staging/ipu7: fix async notifier UAF on probe error path

  isys_register_devices() registers the V4L2 async notifier via
  isys_notifier_init(). If a subsequent pro…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a516d36bdc3d8373f904af57c95e76d6f921cf1c <
    2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81
  - >-
    Linux >= a516d36bdc3d8373f904af57c95e76d6f921cf1c <
    323c411fb63122e8cef5b833032d69d59a838559
  - >-
    Linux >= a516d36bdc3d8373f904af57c95e76d6f921cf1c <
    d7f48aa7d60c65d3e6d5312c27f17d5525a245fb
  - Linux 6.17
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:48:13.544Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89522'
references:
  - url: 'https://git.kernel.org/stable/c/2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81'
  - url: 'https://git.kernel.org/stable/c/323c411fb63122e8cef5b833032d69d59a838559'
  - url: 'https://git.kernel.org/stable/c/d7f48aa7d60c65d3e6d5312c27f17d5525a245fb'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89522.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89522'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532511'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89522'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89522'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89522.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00168
epssPercentile: 0.06142
scores:
  cna: 7.8
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.475Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: staging/ipu7: fix async notifier UAF on probe error path

isys_register_devices() registers the V4L2 async notifier via
isys_notifier_init(). If a subsequent probe step such as
isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label
which only calls isys_unregister_devices(). That helper tears down the
video devices, subdevices, V4L2 device and media device, but never
unregisters or cleans up the async notifier.

As a result the notifier stays chained in the global notifier_list while
the enclosing struct ipu7_isys is freed by devres, leading to list
corruption and a use-after-free the next time the list is walked.

The remove path already does the right thing by calling
isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on
the probe error path so the notifier is unregistered and cleaned up
before the device is torn down.

## Affected

- `Linux >= a516d36bdc3d8373f904af57c95e76d6f921cf1c < 2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81`
- `Linux >= a516d36bdc3d8373f904af57c95e76d6f921cf1c < 323c411fb63122e8cef5b833032d69d59a838559`
- `Linux >= a516d36bdc3d8373f904af57c95e76d6f921cf1c < d7f48aa7d60c65d3e6d5312c27f17d5525a245fb`
- `Linux 6.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89522.json)