{"id":"CVE-2026-80650","summary":"media: atomisp: gc2235: fix UAF and memory leak","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: atomisp: gc2235: fix UAF and memory leak\n\ngc2235_probe() handles its error paths incorrectly.\n\nIf media_entity_pads_init() fails, gc2235_remove() is called, which\ntears down the subdev and frees dev, but then still falls through to\natomisp_register_i2c_module(). This results in use-after-free.\n\nIf atomisp_register_i2c_module() fails, the media entity and control\nhandler are left initialized and dev is leaked.\n\ngc2235_remove() unconditionally calls media_entity_cleanup() and\nv4l2_ctrl_handler_free(), but these are not initialized at every\nerror path in gc2235_probe().\n\nReplace gc2235_remove() calls in the probe error paths with explicit\nunwind labels that free only the resources initialized at each point\nof failure, in reverse order of initialization.","modified":"2026-08-30T03:48:03.995250694Z","published":"2026-08-28T06:48:58.858Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80650.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/628f763aee0047ff44974388d6f70f75a763026b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d57e67ea48e4d095052f2b14d8dd7593621f862f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f614bf0a64aa1cb7444d152a96798a6bf1d49e1f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fdbb8e55578b4ab647fa58827a9dd8730d7f4add"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80650.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80650"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a49d25364dfb9f8a64037488a39ab1f56c5fa419"},{"fixed":"fdbb8e55578b4ab647fa58827a9dd8730d7f4add"},{"fixed":"d57e67ea48e4d095052f2b14d8dd7593621f862f"},{"fixed":"f614bf0a64aa1cb7444d152a96798a6bf1d49e1f"},{"fixed":"628f763aee0047ff44974388d6f70f75a763026b"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80650.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80650.json"}}],"schema_version":"1.9.0"}