https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 04:38:31 +0000 https://vulnerability.circl.lu/vuln/cve-2026-80650 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: atomisp: gc2235: fix UAF and memory leak</p> <p>gc2235_probe() handles its error paths incorrectly.</p> <p>If media_entity_pads_init() fails, gc2235_remove() is called, which tears down the subdev and frees dev, but then still falls through to atomisp_register_i2c_module(). This results in use-after-free.</p> <p>If atomisp_register_i2c_module() fails, the media entity and control handler are left initialized and dev is leaked.</p> <p>gc2235_remove() unconditionally calls media_entity_cleanup() and v4l2_ctrl_handler_free(), but these are not initialized at every error path in gc2235_probe().</p> <p>Replace gc2235_remove() calls in the probe error paths with explicit unwind labels that free only the resources initialized at each point of failure, in reverse order of initialization.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: atomisp: gc2235: fix UAF and memory leak</p> <p>gc2235_probe() handles its error paths incorrectly.</p> <p>If media_entity_pads_init() fails, gc2235_remove() is called, which tears down the subdev and frees dev, but then still falls through to atomisp_register_i2c_module(). This results in use-after-free.</p> <p>If atomisp_register_i2c_module() fails, the media entity and control handler are left initialized and dev is leaked.</p> <p>gc2235_remove() unconditionally calls media_entity_cleanup() and v4l2_ctrl_handler_free(), but these are not initialized at every error path in gc2235_probe().</p> <p>Replace gc2235_remove() calls in the probe error paths with explicit unwind labels that free only the resources initialized at each point of failure, in reverse order of initialization.</p> https://vulnerability.circl.lu/vuln/cve-2026-80650