CVE-2026-89522

The Linux kernel's staging driver for Intel's IPU7 image processing unit (drivers/staging/media/ipu7) leaves a registered V4L2 async notifier chained in the global notifier_list when an intermediate probe step such as isys_fw_log_init() fails after isys_register_devices() has succeeded. The error path only calls isys_unregister_devices(), which tears down the video/media devices but never calls isys_notifier_cleanup(), so when the enclosing struct ipu7_isys is freed via devm-managed resources the notifier remains in the list. The next time that global list is walked, the kernel dereferences freed memory, causing list corruption and a use-after-free that manifests as memory corruption or a system crash. A local attacker with low privileges on a machine where the IPU7 driver probe can be made to fail could in principle turn this into kernel memory corruption with high confidentiality, integrity, and availability impact (CVSS 7.8), though practical exploitation would require inducing the specific error path and no exploit is known to exist. Affected systems are those running kernel configurations that include the staging IPU7 driver on Intel hardware with the IPU7 camera subsystem; exploitation status is none known, with no public PoC and no CISA KEV entry.

What to do: Patch to a kernel release or distro package that includes the fix calling isys_notifier_cleanup() before isys_unregister_devices() on the probe error path. Verify whether your fleet is exposed by checking for CONFIG_VIDEO_INTEL_IPU7 in the kernel config or the ipu7-isys driver loading on Intel Core Ultra hardware with MIPI cameras. If patching is delayed, blacklisting or disabling the staging ipu7 driver (at the cost of the integrated camera) removes the vulnerable code path, and standard local-access hygiene limits the local-attack-vector risk.