CVE-2026-64421: media: nxp: imx8-isi: Fix use-after-free on remove
Vulnerability summary
CVE-2026-64421 is a high (CVSS 7.8) Use After Free vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.2% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 27 · Related 25Timeline
- 25-07-2026PublishedVulnerability first disclosed.
- 17-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in __media_entity_remove_link() during rmmod of imx8_isi: BUG: KASAN: slab-use-after-free in __media_entity_remove_link+0x608/0x650 Read of size 2 at addr ffff0000d47cb02a by task rmmod/724 Call trace: __media_entity_remove_link+0x608/0x650 __media_entity_remove_links+0x78/0x144 __media_device_unregister_entity+0x150/0x280 media_device_unregister_entity+0x48/0x68 v4l2_device_unregister_subdev+0x158/0x300 v4l2_async_unbind_subdev_one+0x22c/0x358 v4l2_async_nf_unbind_all_subdevs+0xfc/0x1c0 v4l2_async_nf_unregister+0x5c/0x14c mxc_isi_remove+0x124/0x2a0 [imx8_isi] Allocated by task 249: __kmalloc_noprof+0x27c/0x690 mxc_isi_crossbar_init+0x22c/0x560 [imx8_isi] Freed by task 724: kfree+0x1e4/0x5b0 mxc_isi_crossbar_cleanup+0x34/0x80 [imx8_isi] mxc_isi_remove+0x11c/0x2a0 [imx8_isi] The problem is that mxc_isi_remove() calls mxc_isi_crossbar_cleanup() before mxc_isi_v4l2_cleanup(). The crossbar cleanup frees the media entity pads, but the subsequent v4l2 cleanup still tries to remove media links that reference those pads. Fix this by calling mxc_isi_v4l2_cleanup() before mxc_isi_crossbar_cleanup() to ensure all media entities are properly unregistered while the pads are still valid.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
Decrease -0.04 pp
From 0.17% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu142 products
- linuxAll versions (No fix recorded) | < 6.8.0-147.147 | < 7.0.0-31.31
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 6.8.0-1067.70 | < 7.0.0-1012.12
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 6.12.100-1 | < 7.1.4-1
- linux-6.12< 6.12.100-1~deb12u1
Linux2 products
- linux≥ cf21f328fcafacf4f96e7a30ef9dceede1076378, < d22fb719654bfde6f682c9f14629f5f9534175b7 | ≥ cf21f328fcafacf4f96e7a30ef9dceede1076378, < ba2aa5d325270cd965c44458c5ff5ab555e6af51 | ≥ cf21f328fcafacf4f96e7a30ef9dceede1076378, < ef382a6baf0a95cf199fdf6bba2fd08e58b0a249 | ≥ cf21f328fcafacf4f96e7a30ef9dceede1076378, < c12a5b2261351cd3b03921ce4720332ff5184b50 | ≥ cf21f328fcafacf4f96e7a30ef9dceede1076378, < b670bf89824ede5d07d20bb9bfbafb754846081d | 6.4
- linux_kernel≥ 6.4, < 6.6.145 | ≥ 6.7, < 6.12.97 | ≥ 6.13, < 6.18.40 | ≥ 6.19, < 7.1.4
3 vendors · 146 products
