Use-after-free in Linux kernel - CVE-2026-80650

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in gc2235_probe() in the atomisp gc2235 driver when handling device initialization errors. A local user can trigger a failing probe path to cause a denial of service.

The issue occurs in driver error-handling paths after partial initialization of subdevice, control handler, or media entity resources.

Affected software

How to mitigate CVE-2026-80650

External References

• https://git.kernel.org/stable/c/628f763aee0047ff44974388d6f70f75a763026b
• https://git.kernel.org/stable/c/d57e67ea48e4d095052f2b14d8dd7593621f862f
• https://git.kernel.org/stable/c/f614bf0a64aa1cb7444d152a96798a6bf1d49e1f
• https://git.kernel.org/stable/c/fdbb8e55578b4ab647fa58827a9dd8730d7f4add

Related Security Bulletins

• Use-after-free in Linux kernel atomisp i2c driver