CVE-2026-68220

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68220", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.375Z", "datePublished": "2026-08-10T12:00:40.434Z", "dateUpdated": "2026-08-17T05:01:06.897Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:01:06.897Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe\n\nBoth mxc_isi_crossbar_init() and mxc_isi_pipe_init() call\nv4l2_subdev_init_finalize() which allocates the subdev active state,\nbut neither mxc_isi_crossbar_cleanup() nor mxc_isi_pipe_cleanup()\ncalls v4l2_subdev_cleanup() to free it.\n\nThis causes a memory leak on every rmmod, reported by kmemleak:\n\n unreferenced object 0xffff0000d06fc800 (size 192):\n comm \"(udev-worker)\", pid 254, jiffies 4294913455\n backtrace (crc 36eeae58):\n kmemleak_alloc+0x34/0x40\n __kvmalloc_node_noprof+0x5f8/0x7d8\n __v4l2_subdev_state_alloc+0x1fc/0x30c\n __v4l2_subdev_init_finalize+0x178/0x368\n\nAdd the missing v4l2_subdev_cleanup() calls before media_entity_cleanup()\nin both crossbar and pipe cleanup paths."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c", "drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"], "versions": [{"version": "cf21f328fcafacf4f96e7a30ef9dceede1076378", "lessThan": "549dd1afce2cf79a826d1f9742effb4565d52871", "status": "affected", "versionType": "git"}, {"version": "cf21f328fcafacf4f96e7a30ef9dceede1076378", "lessThan": "f04ec98605420e7c2c1ad6d2f6fb26692d4f218a", "status": "affected", "versionType": "git"}, {"version": "cf21f328fcafacf4f96e7a30ef9dceede1076378", "lessThan": "9e61258fbc3cfc053e4c2ed72254c2de76772354", "status": "affected", "versionType": "git"}, {"version": "cf21f328fcafacf4f96e7a30ef9dceede1076378", "lessThan": "9c5ddbabc31fda93a508d9b8f0c776a4a08e49f5", "status": "affected", "versionType": "git"}, {"version": "cf21f328fcafacf4f96e7a30ef9dceede1076378", "lessThan": "567418eedd25b3d86d489807682030b4b98b73d9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c", "drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/549dd1afce2cf79a826d1f9742effb4565d52871"}, {"url": "https://git.kernel.org/stable/c/f04ec98605420e7c2c1ad6d2f6fb26692d4f218a"}, {"url": "https://git.kernel.org/stable/c/9e61258fbc3cfc053e4c2ed72254c2de76772354"}, {"url": "https://git.kernel.org/stable/c/9c5ddbabc31fda93a508d9b8f0c776a4a08e49f5"}, {"url": "https://git.kernel.org/stable/c/567418eedd25b3d86d489807682030b4b98b73d9"}], "title": "media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c", "drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "549dd1afce2cf79a826d1f9742effb4565d52871", "status": "affected", "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378", "versionType": "git"}, {"lessThan": "f04ec98605420e7c2c1ad6d2f6fb26692d4f218a", "status": "affected", "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378", "versionType": "git"}, {"lessThan": "9e61258fbc3cfc053e4c2ed72254c2de76772354", "status": "affected", "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378", "versionType": "git"}, {"lessThan": "9c5ddbabc31fda93a508d9b8f0c776a4a08e49f5", "status": "affected", "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378", "versionType": "git"}, {"lessThan": "567418eedd25b3d86d489807682030b4b98b73d9", "status": "affected", "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c", "drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe\n\nBoth mxc_isi_crossbar_init() and mxc_isi_pipe_init() call\nv4l2_subdev_init_finalize() which allocates the subdev active state,\nbut neither mxc_isi_crossbar_cleanup() nor mxc_isi_pipe_cleanup()\ncalls v4l2_subdev_cleanup() to free it.\n\nThis causes a memory leak on every rmmod, reported by kmemleak:\n\n unreferenced object 0xffff0000d06fc800 (size 192):\n comm \"(udev-worker)\", pid 254, jiffies 4294913455\n backtrace (crc 36eeae58):\n kmemleak_alloc+0x34/0x40\n __kvmalloc_node_noprof+0x5f8/0x7d8\n __v4l2_subdev_state_alloc+0x1fc/0x30c\n __v4l2_subdev_init_finalize+0x178/0x368\n\nAdd the missing v4l2_subdev_cleanup() calls before media_entity_cleanup()\nin both crossbar and pipe cleanup paths."}], "id": "CVE-2026-68220", "lastModified": "2026-08-17T05:18:24.213", "metrics": {}, "published": "2026-08-10T13:20:10.020", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/549dd1afce2cf79a826d1f9742effb4565d52871"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/567418eedd25b3d86d489807682030b4b98b73d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9c5ddbabc31fda93a508d9b8f0c776a4a08e49f5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9e61258fbc3cfc053e4c2ed72254c2de76772354"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f04ec98605420e7c2c1ad6d2f6fb26692d4f218a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe", "id": "2513457", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513457"}, "csaw": false, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmedia: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe\nBoth mxc_isi_crossbar_init() and mxc_isi_pipe_init() call\nv4l2_subdev_init_finalize() which allocates the subdev active state,\nbut neither mxc_isi_crossbar_cleanup() nor mxc_isi_pipe_cleanup()\ncalls v4l2_subdev_cleanup() to free it.\nThis causes a memory leak on every rmmod, reported by kmemleak:\nunreferenced object 0xffff0000d06fc800 (size 192):\ncomm \"(udev-worker)\", pid 254, jiffies 4294913455\nbacktrace (crc 36eeae58):\nkmemleak_alloc+0x34/0x40\n__kvmalloc_node_noprof+0x5f8/0x7d8\n__v4l2_subdev_state_alloc+0x1fc/0x30c\n__v4l2_subdev_init_finalize+0x178/0x368\nAdd the missing v4l2_subdev_cleanup() calls before media_entity_cleanup()\nin both crossbar and pipe cleanup paths.", "A flaw was found in the Linux kernel's NXP i.MX8 Image Sensor Interface (ISI) component. This flaw occurs because the system fails to properly free allocated memory when certain subdevice modules are removed. This oversight can lead to a memory leak, potentially impacting system stability and performance over time."], "name": "CVE-2026-68220", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68220\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68220\nhttps://lore.kernel.org/linux-cve-announce/2026081014-CVE-2026-68220-193e@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf21f328fcafacf4f96e7a30ef9dceede1076378,549dd1afce2cf79a826d1f9742effb4565d52871)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf21f328fcafacf4f96e7a30ef9dceede1076378,f04ec98605420e7c2c1ad6d2f6fb26692d4f218a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf21f328fcafacf4f96e7a30ef9dceede1076378,9e61258fbc3cfc053e4c2ed72254c2de76772354)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf21f328fcafacf4f96e7a30ef9dceede1076378,9c5ddbabc31fda93a508d9b8f0c776a4a08e49f5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf21f328fcafacf4f96e7a30ef9dceede1076378,567418eedd25b3d86d489807682030b4b98b73d9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T18:30:04.231500+00:00", "updated": "2026-08-13T09:00:11.361045+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}