CVE-2026-89886 Overview
CVE-2026-89886 is a memory leak vulnerability in the Linux kernel's Intel IPU6 (Image Processing Unit 6) media driver. The flaw resides in the isys_notifier_init() function within the media: intel/ipu6 subsystem. When the function fails to parse or add an fwnode remote subdevice during its initialization loop, it exits through an error path without invoking v4l2_async_nf_cleanup(). Every v4l2_async_connection already added to the notifier's waiting list leaks as a result. The Linux kernel maintainers have resolved the issue across multiple stable branches.
Critical Impact
Repeated initialization failures on systems using the Intel IPU6 camera subsystem can exhaust kernel memory over time, degrading system stability.
Affected Products
- Linux kernel versions containing the intel/ipu6 media driver prior to the fix
- Systems using Intel IPU6-based camera hardware (common in modern Intel-based laptops)
- Distributions shipping affected stable kernel branches referenced in the upstream commits
Discovery Timeline
- 2026-09-16 - CVE-2026-89886 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89886
Vulnerability Analysis
The vulnerability affects the V4L2 (Video4Linux version 2) asynchronous notifier subsystem used by the Intel IPU6 input system driver. isys_notifier_init() first calls v4l2_async_nf_init() to initialize an asynchronous notifier. It then iterates through device tree endpoints, calling v4l2_async_nf_add_fwnode_remote() for each remote subdevice. Each successful call allocates a v4l2_async_connection structure and links it onto the notifier's waiting list.
When an endpoint parse or add operation fails partway through the loop, control jumps to the err_parse label and returns without releasing the connections already allocated. The caller only invokes isys_notifier_cleanup() after isys_notifier_init() returns success, so failed initializations leave the accumulated connection objects orphaned in kernel memory.
Root Cause
The root cause is an incomplete error-handling path (Memory Leak). The register-failure path immediately below err_parse correctly calls v4l2_async_nf_cleanup(), but the parse-failure path omits the same cleanup. This asymmetry between two adjacent error paths within the same function produced the leak.
Attack Vector
Exploitation requires conditions that cause isys_notifier_init() to fail after at least one subdevice has been added. Such failures typically originate from malformed device tree or ACPI firmware descriptions, hardware enumeration errors, or driver reload cycles under fault-injection scenarios. The vulnerability does not provide a direct remote or privilege-escalation primitive; the impact is limited to kernel memory consumption on affected hosts.
No verified public exploit code is available. Technical details are documented in the upstream fix commits: Kernel Git Commit 27b7997, Kernel Git Commit abb1f80, Kernel Git Commit dd5943a, and Kernel Git Commit eee6069.
Detection Methods for CVE-2026-89886
Indicators of Compromise
- Kernel log entries from the ipu6 or intel-ipu6-isys driver reporting endpoint parse failures or v4l2_async_nf_add_fwnode_remote errors during probe.
- Gradual growth of kernel slab allocations attributed to v4l2_async_connection objects without corresponding frees.
- Repeated module load/unload cycles of the IPU6 driver correlated with rising SUnreclaim values in /proc/meminfo.
Detection Strategies
- Audit installed kernel versions across the fleet and compare against the fixed commits referenced in the upstream stable branches.
- Monitor kernel ring buffer (dmesg) output for ipu6 driver initialization failures on systems with Intel camera hardware.
- Use kmemleak on test systems to confirm whether initialization failures produce unreferenced v4l2_async_connection allocations.
Monitoring Recommendations
- Collect kernel logs centrally and alert on repeated IPU6 probe failures.
- Track slab allocator metrics over time on affected endpoints to detect abnormal growth patterns.
- Include kernel version telemetry in endpoint inventory reporting so remediation status is visible to security operations.
How to Mitigate CVE-2026-89886
Immediate Actions Required
- Identify systems running Linux kernels that include the intel/ipu6 driver and have not received the upstream fix.
- Apply vendor kernel updates that incorporate the referenced stable commits.
- Reboot updated systems to activate the patched kernel image.
Patch Information
The fix adds a call to v4l2_async_nf_cleanup() on the parse error path of isys_notifier_init(), aligning it with the adjacent register-failure path. Patched commits are available upstream: 27b7997be552, abb1f808ceab, dd5943aedbe4, and eee6069e4e95. Consume the fix through your Linux distribution's kernel update channel rather than cherry-picking directly in production.
Workarounds
- Where updating is not immediately possible, avoid triggering repeated IPU6 driver reloads on affected hardware.
- Blacklist the ipu6 module on systems that do not require camera functionality until a patched kernel is installed.
- Validate firmware and device tree definitions to reduce the likelihood of endpoint parse failures at driver probe.
# Verify running kernel version and check IPU6 module status
uname -r
lsmod | grep -i ipu6
# Optionally prevent the driver from loading until patched
echo 'blacklist intel_ipu6_isys' | sudo tee /etc/modprobe.d/blacklist-ipu6.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
