CVE-2026-80650: Linux Kernel gc2235 Use-After-Free Flaw

CVE-2026-80650 Overview

CVE-2026-80650 is a use-after-free and memory leak vulnerability in the Linux kernel media: atomisp: gc2235 camera sensor driver. The flaw resides in gc2235_probe(), which mishandles cleanup along its error paths. When media_entity_pads_init() fails, the driver invokes gc2235_remove(), which tears down the subdev and frees the device structure, then execution continues into atomisp_register_i2c_module(), operating on freed memory. A separate path leaks the device allocation and leaves media entity and control handler state initialized when registration fails.

Critical Impact
Local triggering of the flawed probe error path can cause use-after-free conditions in kernel memory, leading to memory corruption, kernel panic, or potential privilege escalation.

Affected Products

Linux kernel — drivers/staging/media/atomisp/i2c/gc2235 driver
Distributions shipping the atomisp staging media driver
Systems using the Intel Atom Image Signal Processor (atomisp) with the gc2235 sensor

Discovery Timeline

2026-08-28 - CVE-2026-80650 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80650

Vulnerability Analysis

The defect involves two interacting bugs in gc2235_probe() error handling. First, when media_entity_pads_init() returns an error, the probe function calls gc2235_remove(), which unwinds the subdev registration and frees the driver-private dev structure. Execution then falls through to atomisp_register_i2c_module(), which dereferences the freed pointer, producing a classic use-after-free [CWE-416].

Second, if atomisp_register_i2c_module() itself fails, the probe function does not release resources initialized earlier. The media entity and V4L2 control handler remain live, and the dev allocation is leaked [CWE-401].

A third defect compounds the first two: gc2235_remove() unconditionally calls media_entity_cleanup() and v4l2_ctrl_handler_free(). Those helpers are unsafe to invoke on structures that were never initialized, which occurs at several probe failure points.

Root Cause

The root cause is incorrect use of a shared cleanup function across probe error paths that have different initialization states. Using gc2235_remove() as a generic unwind handler assumes all resources are fully initialized, which is not true at every error site inside gc2235_probe().

Attack Vector

Exploitation requires reaching the affected probe code path. On systems where the atomisp gc2235 driver binds automatically, an attacker with the ability to induce probe failures — for example through crafted I2C bus conditions, resource pressure, or malicious module loading in constrained environments — can drive the driver into the flawed error path. Successful triggering yields use-after-free access to kernel memory allocated for the sensor device.

The upstream fix replaces gc2235_remove() in the probe error paths with explicit unwind labels that free only the resources initialized at each failure point, in reverse order of initialization.

Detection Methods for CVE-2026-80650

Indicators of Compromise

Kernel panics or general protection fault messages referencing gc2235_probe, gc2235_remove, or atomisp_register_i2c_module
KASAN reports flagging use-after-free reads or writes inside the atomisp gc2235 driver
Sudden reboots on devices using the atomisp media stack with a gc2235 sensor

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to identify the UAF at probe time
Audit dmesg and journalctl -k for repeated probe failures of the gc2235 I2C module
Track kernel version and staging driver inclusion across the fleet to identify hosts running affected builds

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on oops or KASAN signatures involving gc2235 or atomisp
Monitor for unexpected module load or unload events on atomisp_gmin_platform and gc2235
Correlate camera subsystem errors with subsequent system instability on Intel Atom-based devices

How to Mitigate CVE-2026-80650

Immediate Actions Required

Apply the upstream kernel patches referenced by the maintainers as soon as vendor builds are available
Inventory Intel Atom-based endpoints and embedded devices that use the atomisp media stack with the gc2235 sensor
Restrict local access on systems that cannot be patched immediately, since the flaw is reached through the local driver probe path

Patch Information

The fix rewrites gc2235_probe() error handling to use explicit goto unwind labels that release only the resources initialized up to the point of failure. It also removes the misuse of gc2235_remove() as a generic cleanup handler. Patches are available in the mainline and stable trees:

Workarounds

Blocklist the gc2235 kernel module on systems that do not require the camera sensor
Disable or unbuild the atomisp staging driver in custom kernel configurations where the hardware is absent
Limit unprivileged local access to reduce the ability to trigger repeated probe failures

bash

# Prevent the vulnerable driver from loading until patches are applied
echo "blacklist gc2235" | sudo tee /etc/modprobe.d/blacklist-gc2235.conf
echo "install gc2235 /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-gc2235.conf
sudo update-initramfs -u