Review reviewHigh

CVE-2026-64447

Linux

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7_isys_init() and ipu7_psys_init(), pdata is allocated and then passed to ipu7_bus_initialize_device(), which stores it in adev->pdata. The ipu7_bus_release() function frees adev->pdata when the device's reference count drops to zero. Two error paths incorrectly call kfree(pdata) after the device teardown has already freed it: 1. When ipu7_mmu_init() fails: put_device() is called, which drops the reference count to zero and triggers ipu7_bus_...

CVSS: 7.8
EPSS: -
CISA KEV: Not listed
Published: 2026.07.25

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5 < b5ddc7257bee71f5b8cf9083e2b0ac0427e9fbb3, >= b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5 < 837c1f9655421055f751ed34745e820a54a27642, >= b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5 < d3a9a8cf2d7fd61a2f63df61f6cbc0a9bb007cc0, >= 6.17
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: Not available