CVE-2026-89522
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel's media staging/ipu7 driver, isys_register_devices() registers the V4L2 async notifier, but the probe error path (isys_probe()) only calls isys_unregister_devices(), which does not unregister or clean up the notifier. As a result, the notifier stays on the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked.
Risk Assessment
This can cause kernel memory corruption and use-after-free, leading to system crash (denial of service) or potentially kernel code execution.
Recommendation
Update the Linux kernel to a version containing the fix that calls isys_notifier_cleanup() before isys_unregister_devices() on the probe error path as well. Until then, avoid configurations that trigger ipu7 driver probe failures.
Related vulnerabilities
- CVE-2026-118769Critical
In the Botan C++ cryptography library, the C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher, causing the reported size to be truncated, insufficient memory allocation, and later memory corruption. The issue is fixed in version 3.13.0.
- CVE-2026-118762Critical
In the Monkeytype repository, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the fork-controlled oxfmt binary. Because actions/checkout persists the elevated GITHUB_TOKEN in Git configuration until after untrusted code executes, an external contributor can run arbitrary code, read or exfiltrate the token, and push repository content or modify pull requests and issues. The issue affects the repository CI workflow, not the Monkeytype application or user data, and is fixed in version 26.43.0.
- CVE-2026-93680Critical
IBM Langflow OSS versions 1.0.0 through 1.12.8 contain an improper authentication flaw that could allow a remote attacker to bypass security restrictions.
- CVE-2026-90868Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution under certain configurations.
- CVE-2026-90866Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
- CVE-2026-90865Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution with elevated privileges under certain configurations.
- CVE-2026-90864Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access or modify files outside their authorized scope.
- CVE-2026-90863Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows have missing authorization in the administrative interface that could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
- CVE-2026-84295Critical
Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows contain an improper authentication flaw that could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
- CVE-2026-62131Critical
Zoho Flow versions up to and including 2.14.5 contain an unauthenticated PHP Object Injection vulnerability that could allow an attacker to manipulate objects within the application.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys_register_devices() registers the V4L2 async notifier via isys_notifier_init(). If a subsequent probe step such as isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label which only calls isys_unregister_devices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier. As a result the notifier stays chained in the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked. The remove path already does the right thing by calling isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS