---
cve: "CVE-2026-64421"
severity: "LOW"
cvss: 3.1
epss: "17%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-07-25 10:17:26"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-05T17:53:22+02:00"
---

# CVE-2026-64421

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

media: nxp: imx8-isi: Fix use-after-free on remove

KASAN reports a slab-use-after-free in __media_entity_remove_link()
during rmmod of imx8_isi:

  BUG: KASAN: slab-use-after-free in __media_entity_remove_link+0x608/0x650
  Read of size 2 at addr ffff0000d47cb02a by task rmmod/724

  Call trace:
   __media_entity_remove_link+0x608/0x650
   __media_entity_remove_links+0x78/0x144
   __media_device_unregister_entity+0x150/0x280
   media_device_unregister_entity+0x48/0x68
   v4l2_device_unregister_subdev+0x158/0x300
   v4l2_async_unbind_subdev_one+0x22c/0x358
   v4l2_async_nf_unbind_all_subdevs+0xfc/0x1c0
   v4l2_async_nf_unregister+0x5c/0x14c
   mxc_isi_remove+0x124/0x2a0 [imx8_isi]

  Allocated by task 249:
   __kmalloc_noprof+0x27c/0x690
   mxc_isi_crossbar_init+0x22c/0x560 [imx8_isi]

  Freed by task 724:
   kfree+0x1e4/0x5b0
   mxc_isi_crossbar_cleanup+0x34/0x80 [imx8_isi]
   mxc_isi_remove+0x11c/0x2a0 [imx8_isi]

The problem is that mxc_isi_remove() calls mxc_isi_crossbar_cleanup()
before mxc_isi_v4l2_cleanup(). The crossbar cleanup frees the media
entity pads, but the subsequent v4l2 cleanup still tries to remove
media links that reference those pads.

Fix this by calling mxc_isi_v4l2_cleanup() before
mxc_isi_crossbar_cleanup() to ensure all media entities are properly
unregistered while the pads are still valid.

## Patch verfügbar (OSV)

- Kernel ≥ 6.6.145
- Kernel ≥ 6.12.97
- Kernel ≥ 6.18.40
- Kernel ≥ 7.1.4

## Referenzen

- <https://git.kernel.org/stable/c/d22fb719654bfde6f682c9f14629f5f9534175b7>
- <https://git.kernel.org/stable/c/ba2aa5d325270cd965c44458c5ff5ab555e6af51>
- <https://git.kernel.org/stable/c/ef382a6baf0a95cf199fdf6bba2fd08e58b0a249>
- <https://git.kernel.org/stable/c/c12a5b2261351cd3b03921ce4720332ff5184b50>
- <https://git.kernel.org/stable/c/b670bf89824ede5d07d20bb9bfbafb754846081d>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-64421) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_