CVE-2026-64447: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64447 Overview

CVE-2026-64447 is a memory corruption vulnerability in the Linux kernel's staging/media/ipu7 driver. The flaw involves both a double-free and a use-after-free condition in the error handling paths of ipu7_isys_init() and ipu7_psys_init(). When ipu7_mmu_init() or ipu7_bus_add_device() fails, the driver calls kfree(pdata) on memory already freed by ipu7_bus_release(). The same error paths also dereference a freed adev pointer via ERR_CAST() when constructing the return value. Local attackers with low privileges can trigger these paths to corrupt kernel memory.

Critical Impact
Successful exploitation of the double-free and use-after-free conditions may lead to kernel memory corruption, local privilege escalation, or denial of service on affected Linux systems.

Affected Products

Linux kernel staging/media/ipu7 driver (Intel IPU7 media staging driver)
Linux kernel versions prior to the fixes committed as 837c1f96, b5ddc725, and d3a9a8cf
Distributions shipping the affected staging driver

Discovery Timeline

2026-07-25 - CVE-2026-64447 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64447

Vulnerability Analysis

The vulnerability resides in the Intel IPU7 (Image Processing Unit) staging media driver. Both ipu7_isys_init() and ipu7_psys_init() allocate a pdata structure and pass it to ipu7_bus_initialize_device(), which stores the pointer in adev->pdata. Ownership of that memory transfers to the auxiliary device, and ipu7_bus_release() frees adev->pdata when the device's reference count reaches zero.

Two error paths violate this ownership model. When ipu7_mmu_init() fails, the driver calls put_device(), which drops the reference count and triggers ipu7_bus_release() to free pdata. The subsequent explicit kfree(pdata) produces a double-free. The same pattern occurs when ipu7_bus_add_device() fails, since it internally invokes auxiliary_device_uninit() and the release callback.

Root Cause

The root cause is inconsistent ownership tracking of pdata across the driver's initialization and teardown flow [Double Free, Use After Free]. The error paths did not account for the release callback having already freed the buffer through the auxiliary device subsystem. Additionally, the error code returned by dev_err_probe() was not saved before put_device(), causing ERR_CAST(adev) to dereference a freed adev pointer when building the return value.

Attack Vector

Exploitation requires local access with low privileges on a system loading the vulnerable IPU7 staging driver. An attacker capable of triggering initialization failures in ipu7_mmu_init() or ipu7_bus_add_device() can force the driver into the vulnerable error paths. The resulting double-free and use-after-free may be leveraged for kernel heap corruption, information disclosure, or privilege escalation depending on heap layout and allocator state.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream fixes referenced in the Kernel.org commit 837c1f96 for the exact code changes.

Detection Methods for CVE-2026-64447

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ipu7_isys_init, ipu7_psys_init, or ipu7_bus_release in dmesg output
KASAN (Kernel Address Sanitizer) reports flagging double-free or use-after-free in the IPU7 media staging path
Repeated device probe failures for the IPU7 auxiliary bus followed by system instability

Detection Strategies

Enable KASAN on test kernels to surface double-free and use-after-free conditions during IPU7 driver initialization
Monitor kernel logs for slab corruption warnings correlated with media subsystem load or probe events
Inventory hosts running kernels that include the vulnerable staging/media/ipu7 driver and cross-reference against the patched commit hashes

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized logging pipeline to detect crashes tied to the IPU7 driver
Alert on unexpected kernel module load failures involving ipu7, ipu7-isys, or ipu7-psys
Track host uptime anomalies and reboot events on systems with Intel IPU7 hardware

How to Mitigate CVE-2026-64447

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 837c1f96, b5ddc725, and d3a9a8cf as soon as vendor packages are available
If the IPU7 hardware is not required, blacklist the ipu7 staging driver to prevent it from loading
Restrict local access to trusted users, since exploitation requires local privileges

Patch Information

The fix removes the redundant kfree(pdata) calls in the error paths of ipu7_isys_init() and ipu7_psys_init(), and saves the error code from dev_err_probe() before calling put_device(). The corrected paths return ERR_PTR() with the saved error instead of ERR_CAST() on a freed pointer. Refer to the Kernel.org commit b5ddc725 and Kernel.org commit d3a9a8cf for the exact changes.

Workarounds

Blacklist the affected staging driver by adding blacklist ipu7 to /etc/modprobe.d/blacklist-ipu7.conf and rebuilding the initramfs
Disable the CONFIG_VIDEO_INTEL_IPU7 option and rebuild the kernel where custom builds are used
Limit shell access on systems with Intel IPU7 hardware until the patched kernel is deployed

bash

# Blacklist the vulnerable IPU7 staging driver
echo 'blacklist ipu7' | sudo tee /etc/modprobe.d/blacklist-ipu7.conf
sudo update-initramfs -u
sudo reboot

# Verify the module is not loaded after reboot
lsmod | grep ipu7