Answer in brief
CVE-2026-89522 records a Unknown severity vulnerability in media: staging/ipu7: fix async notifier UAF on probe error path. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a516d36bdc3d8373f904af57c95e76d6f921cf1c <2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81 || >=a516d36bdc3d8373f904af57c95e76d6f921cf1c <323c411fb63122e8cef5b833032d69d59a838559 || >=a516d36bdc3d8373f904af57c95e76d6f921cf1c <d7f48aa7d60c65d3e6d5312c27f17d5525a245fb | 2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81, 323c411fb63122e8cef5b833032d69d59a838559, d7f48aa7d60c65d3e6d5312c27f17d5525a245fb |
| Linux/Linuxgeneric | 6.17 | Not reported |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys_register_devices() registers the V4L2 async notifier via isys_notifier_init(). If a subsequent probe step such as isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label which only calls isys_unregister_devices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier. As a result the notifier stays chained in the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked. The remove path already does the right thing by calling isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down.
Quoted source text, attributed separately from HOL analysis.