Cloudanix VulnDB

CVE-2026-93070

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in Linux camera hardware support can let a logged-in user damage system memory and potentially take full control.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Double-free of auxiliary device pdata pointers in the IPU6 media driver during error unwinding after ipu6_bus_initialize_device() succeeds, allowing kernel memory corruption.

Why it matters to the business

Local memory corruption on systems using the affected Intel IPU6 driver can lead to kernel crashes, denial of service, or privilege escalation; low public exploit activity reduces immediate widespread risk but still requires prompt kernel updates on affected hardware.

How an attack unfolds

An attacker with local access triggers an error path (such as MMU initialization failure) after the auxiliary device is registered; the code then executes both the bus release callback and an extra kfree on the same pdata object, corrupting kernel memory structures.

How to fix it

Apply the upstream kernel patch that removes the manual pdata kfree calls after auxiliary_device initialization; rebuild and deploy the corrected kernel on all affected systems.

How to confirm the fix worked

Inspect the ipu6-bus.c source to confirm removal of the extra kfree(pdata) statements after auxiliary_device_add succeeds; verify the driver no longer double-frees on error paths during manual testing of init failures.

Typical attack path

  1. Obtain local user access on a Linux system with the IPU6 driver loaded
  2. Force an initialization error condition in ipu6_bus_initialize_device for isys or psys
  3. Trigger the double-free via the conflicting put_device and manual kfree paths
  4. Leverage resulting kernel memory corruption for crash or privilege escalation

How to detect it

Review kernel logs for oops or panic messages referencing ipu6_bus or auxiliary device pdata during driver initialization; examine crash dumps for double-free signatures in the media subsystem.

What your security team should do

  • Prioritize kernel updates on all systems exposing the IPU6 media driver
  • Monitor upstream stable kernel releases for the backported fix
  • Limit local access on high-value systems until patched

The record

In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Do not free aux device pdata after init ipu6_bus_initialize_device() stores the isys/psys pdata pointer in struct ipu6_bus_device and initializes the auxiliary device. After that point, error unwinding must drop the auxiliary device reference and let ipu6_bus_release() free both the bus device and adev->pdata. The isys and psys init paths already call put_device() when MMU initialization fails, and ipu6_bus_add_device() calls auxiliary_device_uninit() on auxiliary_device_add() failure. Both paths therefore run the bus release callback. The extra kfree(pdata) in the callers can release the same object a second time. Remove the manual pdata frees after the auxiliary device has been initialized. This issue was found by a static analysis checker and confirmed by manual source review.

Affected packages

Ecosystem Package Introduced Fixed