CVE-2026-64421 Overview
CVE-2026-64421 is a use-after-free vulnerability in the Linux kernel's NXP imx8-isi media driver. The flaw affects the Image Sensor Interface (ISI) V4L2 subdevice driver used on i.MX8 platforms. Kernel Address Sanitizer (KASAN) reports a slab-use-after-free in __media_entity_remove_link() triggered during rmmod of imx8_isi. The removal path frees media entity pads before subsequent V4L2 cleanup dereferences them. The issue was resolved upstream by reordering cleanup calls in mxc_isi_remove().
Critical Impact
Local users with the ability to unload the imx8_isi kernel module can trigger a slab-use-after-free that may lead to kernel memory corruption or denial of service on affected NXP i.MX8 systems.
Affected Products
- Linux kernel builds shipping the NXP imx8-isi media driver (drivers/media/platform/nxp/imx8-isi)
- NXP i.MX8 platform kernels using the V4L2 ISI crossbar subdevice
- Downstream distribution kernels prior to backporting the referenced stable commits
Discovery Timeline
- 2026-07-25 - CVE-2026-64421 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64421
Vulnerability Analysis
The vulnerability is a slab-use-after-free [CWE-416] in the module removal path of the imx8_isi V4L2 driver. During rmmod, mxc_isi_remove() calls mxc_isi_crossbar_cleanup() before mxc_isi_v4l2_cleanup(). The crossbar cleanup frees the media entity pads that were previously allocated by mxc_isi_crossbar_init() via __kmalloc_noprof().
The subsequent V4L2 cleanup path invokes v4l2_async_nf_unregister(), which walks subdevices through v4l2_async_nf_unbind_all_subdevs() and eventually reaches __media_entity_remove_link(). That function performs a 2-byte read against pad metadata that has already been released to the slab allocator. KASAN records the freed allocation stack in mxc_isi_crossbar_cleanup() and the offending read at offset 0x608 inside __media_entity_remove_link().
Root Cause
The root cause is an incorrect ordering of teardown operations in the driver's remove callback. Media entities must remain registered while their pads are live, because media_device_unregister_entity() iterates and removes links that reference those pads. Freeing pad storage before unregistering the entities leaves dangling pointers inside the media graph.
Attack Vector
Exploitation requires local privileges sufficient to unload the kernel module, typically CAP_SYS_MODULE. Triggering the bug does not require network access or user interaction from other accounts. The immediate consequence is kernel memory corruption reachable during module removal, which can produce a kernel oops or, under favorable heap conditions, be shaped into further memory safety violations.
See the upstream patches for exact source-level changes: Kernel Git Commit b670bf8, Kernel Git Commit ba2aa5d, Kernel Git Commit c12a5b2, Kernel Git Commit d22fb71, and Kernel Git Commit ef382a6.
Detection Methods for CVE-2026-64421
Indicators of Compromise
- Kernel log entries containing KASAN: slab-use-after-free in __media_entity_remove_link correlated with the imx8_isi module.
- Kernel oops or panic traces referencing mxc_isi_remove, mxc_isi_crossbar_cleanup, or v4l2_async_nf_unregister on i.MX8 hardware.
- Unexpected rmmod imx8_isi events on production media appliances where module removal is not part of normal operations.
Detection Strategies
- Enable KASAN on development and pre-production kernels for i.MX8 platforms to catch the bug deterministically at module unload.
- Audit kernel version and driver source for the presence of the fixed cleanup ordering in mxc_isi_remove().
- Correlate dmesg output with process auditing to detect rmmod invocations that immediately precede kernel warnings.
Monitoring Recommendations
- Ship kernel ring buffer (dmesg, /dev/kmsg) and journald kernel messages to a central log store and alert on KASAN, BUG:, and Call trace: markers.
- Monitor init_module and delete_module syscalls via auditd or eBPF on embedded i.MX8 fleets.
- Track kernel package versions across affected NXP i.MX8 devices to confirm patch adoption.
How to Mitigate CVE-2026-64421
Immediate Actions Required
- Update to a Linux kernel release that includes the fix reordering mxc_isi_v4l2_cleanup() before mxc_isi_crossbar_cleanup() in mxc_isi_remove().
- Restrict CAP_SYS_MODULE to trusted administrators and disable dynamic module unloading where operationally feasible.
- Inventory NXP i.MX8 devices running the imx8_isi driver and prioritize them for kernel updates.
Patch Information
The fix has been merged into the upstream stable trees. Apply the vendor kernel update containing any of the referenced commits: b670bf89824e, ba2aa5d32527, c12a5b226135, d22fb7196545, or ef382a6baf0a. The corrected sequence calls mxc_isi_v4l2_cleanup() first so that media entities are unregistered while their pads remain valid, then releases pad memory in mxc_isi_crossbar_cleanup().
Workarounds
- Build kernels with CONFIG_MODULE_UNLOAD=n on devices where the ISI driver is required but module removal is not.
- Avoid running rmmod imx8_isi on unpatched systems; reboot instead when the driver must be reinitialized.
- Limit shell and administrative access on affected embedded devices to reduce exposure to local triggers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
