Bug 2513457 (CVE-2026-68220) - CVE-2026-68220 kernel: media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe
Summary: CVE-2026-68220 kernel: media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup(...
Keywords:
Status: NEW
Alias: CVE-2026-68220
Product: Security Response
Classification: Other
Component: vulnerability-draft
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-10 12:38 UTC by OSIDB Bzimport
Modified: 2026-08-11 11:23 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-10 12:38:26 UTC
In the Linux kernel, the following vulnerability has been resolved:

media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe

Both mxc_isi_crossbar_init() and mxc_isi_pipe_init() call
v4l2_subdev_init_finalize() which allocates the subdev active state,
but neither mxc_isi_crossbar_cleanup() nor mxc_isi_pipe_cleanup()
calls v4l2_subdev_cleanup() to free it.

This causes a memory leak on every rmmod, reported by kmemleak:

  unreferenced object 0xffff0000d06fc800 (size 192):
    comm "(udev-worker)", pid 254, jiffies 4294913455
    backtrace (crc 36eeae58):
      kmemleak_alloc+0x34/0x40
      __kvmalloc_node_noprof+0x5f8/0x7d8
      __v4l2_subdev_state_alloc+0x1fc/0x30c
      __v4l2_subdev_init_finalize+0x178/0x368

Add the missing v4l2_subdev_cleanup() calls before media_entity_cleanup()
in both crossbar and pipe cleanup paths.

Comment 1 Mauro Matteo Cascella 2026-08-11 11:17:53 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081014-CVE-2026-68220-193e@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.