CVE-2026-64447: staging: media: ipu7: fix double-free and use-after-free in error paths

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

staging: media: ipu7: fix double-free and use-after-free in error paths

In both ipu7_isys_init() and ipu7_psys_init(), pdata is allocated and
then passed to ipu7_bus_initialize_device(), which stores it in
adev->pdata. The ipu7_bus_release() function frees adev->pdata when the
device's reference count drops to zero.

Two error paths incorrectly call kfree(pdata) after the device teardown
has already freed it:

1. When ipu7_mmu_init() fails: put_device() is called, which drops the
   reference count to zero and triggers ipu7_bus_release() ->
   kfree(pdata). The subsequent kfree(pdata) is a double-free.

2. When ipu7_bus_add_device() fails: it calls auxiliary_device_uninit()
   internally, which calls put_device() -> ipu7_bus_release() ->
   kfree(pdata). The subsequent kfree(pdata) is again a double-free.

Note that the kfree(pdata) when ipu7_bus_initialize_device() itself
fails is correct, because in that case auxiliary_device_init() failed
and the release function was never set up, so pdata must be freed
manually.

Additionally, the error code was not saved before calling put_device(),
causing ERR_CAST() to dereference the already-freed adev pointer when
constructing the return value. Fix this by saving the error from
dev_err_probe() before put_device() and returning ERR_PTR() instead.

Remove the redundant kfree(pdata) calls and fix the use-after-free in
the return values of the two affected error paths.

The Linux kernel CVE team has assigned CVE-2026-64447 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.17 with commit b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5 and fixed in 6.18.39 with commit b5ddc7257bee71f5b8cf9083e2b0ac0427e9fbb3
	Issue introduced in 6.17 with commit b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5 and fixed in 7.1.4 with commit 837c1f9655421055f751ed34745e820a54a27642
	Issue introduced in 6.17 with commit b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5 and fixed in 7.2-rc1 with commit d3a9a8cf2d7fd61a2f63df61f6cbc0a9bb007cc0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64447
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/staging/media/ipu7/ipu7.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b5ddc7257bee71f5b8cf9083e2b0ac0427e9fbb3
	https://git.kernel.org/stable/c/837c1f9655421055f751ed34745e820a54a27642
	https://git.kernel.org/stable/c/d3a9a8cf2d7fd61a2f63df61f6cbc0a9bb007cc0