CVE-2026-89522: Linux Kernel IPU7 Use-After-Free Vulnerability

CVE-2026-89522 Overview

CVE-2026-89522 is a use-after-free vulnerability in the Linux kernel's staging/ipu7 media driver. The flaw exists in the isys_register_devices() probe error path, which fails to unregister the V4L2 async notifier before tearing down the device. When isys_fw_log_init() or a similar probe step fails, control jumps to the out_cleanup label that only invokes isys_unregister_devices(). The notifier remains chained in the global notifier_list while the enclosing struct ipu7_isys is freed by devres, corrupting the list and enabling a use-after-free the next time it is walked.

Critical Impact
Local attackers with low privileges can trigger kernel memory corruption, leading to privilege escalation, kernel information disclosure, or system crash.

Affected Products

Linux kernel with the staging/ipu7 media driver enabled
Kernel builds shipping the Intel IPU7 image signal processor stack
Stable trees prior to commits 2a8dd9fd12f3, 323c411fb631, and d7f48aa7d60c

Discovery Timeline

2026-09-11 - CVE-2026-89522 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89522

Vulnerability Analysis

The vulnerability sits in the probe sequence of the Intel IPU7 image processing unit driver in drivers/staging/media/ipu7. During isys_register_devices(), the driver calls isys_notifier_init() to register a V4L2 async notifier on the global notifier_list. If a subsequent initialization step such as isys_fw_log_init() fails, isys_probe() jumps to out_cleanup and calls only isys_unregister_devices().

That helper releases the video devices, subdevices, V4L2 device, and media device. It never invokes isys_notifier_cleanup(). The devres subsystem then frees the enclosing struct ipu7_isys, but the notifier remains linked into the kernel-wide list. Any subsequent traversal of notifier_list dereferences freed memory, producing list corruption and a classic use-after-free condition [CWE-416].

Root Cause

The probe error path is asymmetric with the remove path. isys_remove() correctly calls isys_notifier_cleanup() before isys_unregister_devices(). The out_cleanup label in isys_probe() omits the notifier cleanup step, leaving a dangling reference to freed memory in a global list.

Attack Vector

Exploitation requires local access with the ability to trigger probe failures on the IPU7 device. An attacker who can induce firmware log initialization errors, or otherwise force a probe failure after notifier registration, can leave the corrupted notifier on the global list. A follow-on notifier walk then dereferences freed memory. Successful exploitation can be leveraged for kernel-level code execution or denial of service. See the Linux Kernel Commit 2a8dd9f for the fix implementation.

No public proof-of-concept exploit is available. The upstream fix mirrors the remove path by invoking isys_notifier_cleanup() on the probe error branch before device teardown.

Detection Methods for CVE-2026-89522

Indicators of Compromise

Kernel warnings referencing list corruption in notifier_list or V4L2 async notifier structures
KASAN or SLUB debug reports flagging use-after-free in drivers/staging/media/ipu7
Unexpected isys_probe failures followed by kernel oops or panic during subsequent media subsystem operations

Detection Strategies

Enable CONFIG_KASAN and CONFIG_DEBUG_LIST on test kernels to surface list corruption originating from the IPU7 driver
Audit installed kernel package versions against the fix commits 2a8dd9fd12f3, 323c411fb631, and d7f48aa7d60c
Correlate kernel crash telemetry with recent hardware probe events on systems shipping Intel IPU7 hardware

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform and alert on general protection fault, KASAN: use-after-free, or list_add corruption strings
Track kernel module load and unload events for intel-ipu7-isys on production endpoints
Monitor for repeated probe failures on media devices, which may indicate exploitation attempts

How to Mitigate CVE-2026-89522

Immediate Actions Required

Apply the upstream stable kernel updates containing commits 2a8dd9fd12f3, 323c411fb631, and d7f48aa7d60c
Restrict local access on systems with the IPU7 driver loaded until patches are deployed
Blacklist the intel-ipu7-isys module on systems where the IPU7 hardware is not required

Patch Information

The fix adds isys_notifier_cleanup() to the out_cleanup error path in isys_probe(), ensuring the V4L2 async notifier is unregistered before the enclosing structure is freed. Patch commits are available in the mainline and stable trees: Linux Kernel Commit 2a8dd9f, Linux Kernel Commit 323c411f, and Linux Kernel Commit d7f48aa7.

Workarounds

Unload or blacklist the IPU7 media driver where camera functionality is not required
Enforce strict local access controls and remove unnecessary user accounts from systems exposing IPU7 hardware
Enable kernel lockdown mode where feasible to reduce the attack surface for local privilege escalation

bash

# Blacklist the IPU7 staging driver until patches are applied
echo 'blacklist intel-ipu7-isys' | sudo tee /etc/modprobe.d/blacklist-ipu7.conf
sudo update-initramfs -u
sudo reboot