CVE-2026-89886

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: intel/ipu6: fix async notifier cleanup leak on parse error

isys_notifier_init() calls v4l2_async_nf_init() and then adds fwnode

remote subdevs in a loop with v4l2_async_nf_add_fwnode_remote(). If an

endpoint parse or add fails partway through the loop, it jumps to

err_parse and returns without calling v4l2_async_nf_cleanup(), leaking

every v4l2_async_connection already added to the notifier's waiting

list.

The register-failure path just below already cleans up correctly, and

the caller only tears the notifier down (isys_notifier_cleanup()) once

isys_notifier_init() has returned success. Clean up the notifier on the

parse error path too.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References