CVE-2026-80650

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80650", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.779Z", "datePublished": "2026-08-28T06:48:58.858Z", "dateUpdated": "2026-10-30T12:30:52.133Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:30:52.133Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: atomisp: gc2235: fix UAF and memory leak\n\ngc2235_probe() handles its error paths incorrectly.\n\nIf media_entity_pads_init() fails, gc2235_remove() is called, which\ntears down the subdev and frees dev, but then still falls through to\natomisp_register_i2c_module(). This results in use-after-free.\n\nIf atomisp_register_i2c_module() fails, the media entity and control\nhandler are left initialized and dev is leaked.\n\ngc2235_remove() unconditionally calls media_entity_cleanup() and\nv4l2_ctrl_handler_free(), but these are not initialized at every\nerror path in gc2235_probe().\n\nReplace gc2235_remove() calls in the probe error paths with explicit\nunwind labels that free only the resources initialized at each point\nof failure, in reverse order of initialization."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/media/atomisp/i2c/atomisp-gc2235.c"], "versions": [{"version": "a49d25364dfb9f8a64037488a39ab1f56c5fa419", "lessThan": "51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654", "status": "affected", "versionType": "git"}, {"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e", "lessThan": "5bed166be3054f9ebb527dbce7158677085eea59", "status": "affected", "versionType": "git"}, {"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e", "lessThan": "592a0e78ab08f6373c40912365759d8a066e7711", "status": "affected", "versionType": "git"}, {"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e", "lessThan": "fdbb8e55578b4ab647fa58827a9dd8730d7f4add", "status": "affected", "versionType": "git"}, {"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e", "lessThan": "d57e67ea48e4d095052f2b14d8dd7593621f862f", "status": "affected", "versionType": "git"}, {"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e", "lessThan": "f614bf0a64aa1cb7444d152a96798a6bf1d49e1f", "status": "affected", "versionType": "git"}, {"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e", "lessThan": "628f763aee0047ff44974388d6f70f75a763026b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/media/atomisp/i2c/atomisp-gc2235.c"], "versions": [{"version": "4.12", "status": "affected"}, {"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "4.12", "status": "unaffected", "versionType": "semver"}, {"version": "4.18", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "4.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"}, {"url": "https://git.kernel.org/stable/c/5bed166be3054f9ebb527dbce7158677085eea59"}, {"url": "https://git.kernel.org/stable/c/592a0e78ab08f6373c40912365759d8a066e7711"}, {"url": "https://git.kernel.org/stable/c/fdbb8e55578b4ab647fa58827a9dd8730d7f4add"}, {"url": "https://git.kernel.org/stable/c/d57e67ea48e4d095052f2b14d8dd7593621f862f"}, {"url": "https://git.kernel.org/stable/c/f614bf0a64aa1cb7444d152a96798a6bf1d49e1f"}, {"url": "https://git.kernel.org/stable/c/628f763aee0047ff44974388d6f70f75a763026b"}], "title": "media: atomisp: gc2235: fix UAF and memory leak", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/staging/media/atomisp/i2c/atomisp-gc2235.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654", "status": "affected", "version": "a49d25364dfb9f8a64037488a39ab1f56c5fa419", "versionType": "git"}, {"lessThan": "5bed166be3054f9ebb527dbce7158677085eea59", "status": "affected", "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e", "versionType": "git"}, {"lessThan": "592a0e78ab08f6373c40912365759d8a066e7711", "status": "affected", "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e", "versionType": "git"}, {"lessThan": "fdbb8e55578b4ab647fa58827a9dd8730d7f4add", "status": "affected", "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e", "versionType": "git"}, {"lessThan": "d57e67ea48e4d095052f2b14d8dd7593621f862f", "status": "affected", "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e", "versionType": "git"}, {"lessThan": "f614bf0a64aa1cb7444d152a96798a6bf1d49e1f", "status": "affected", "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e", "versionType": "git"}, {"lessThan": "628f763aee0047ff44974388d6f70f75a763026b", "status": "affected", "version": "ad85094b293e40e7a2f831b0311a389d952ebd5e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/staging/media/atomisp/i2c/atomisp-gc2235.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"status": "affected", "version": "5.8"}, {"lessThan": "4.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThan": "5.8", "status": "unaffected", "version": "4.18", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: atomisp: gc2235: fix UAF and memory leak\n\ngc2235_probe() handles its error paths incorrectly.\n\nIf media_entity_pads_init() fails, gc2235_remove() is called, which\ntears down the subdev and frees dev, but then still falls through to\natomisp_register_i2c_module(). This results in use-after-free.\n\nIf atomisp_register_i2c_module() fails, the media entity and control\nhandler are left initialized and dev is leaked.\n\ngc2235_remove() unconditionally calls media_entity_cleanup() and\nv4l2_ctrl_handler_free(), but these are not initialized at every\nerror path in gc2235_probe().\n\nReplace gc2235_remove() calls in the probe error paths with explicit\nunwind labels that free only the resources initialized at each point\nof failure, in reverse order of initialization."}], "id": "CVE-2026-80650", "lastModified": "2026-10-30T13:20:09.463", "metrics": {}, "published": "2026-08-28T08:16:50.010", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/592a0e78ab08f6373c40912365759d8a066e7711"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5bed166be3054f9ebb527dbce7158677085eea59"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/628f763aee0047ff44974388d6f70f75a763026b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d57e67ea48e4d095052f2b14d8dd7593621f862f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f614bf0a64aa1cb7444d152a96798a6bf1d49e1f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fdbb8e55578b4ab647fa58827a9dd8730d7f4add"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: media: atomisp: gc2235: fix UAF and memory leak", "id": "2525482", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525482"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmedia: atomisp: gc2235: fix UAF and memory leak\ngc2235_probe() handles its error paths incorrectly.\nIf media_entity_pads_init() fails, gc2235_remove() is called, which\ntears down the subdev and frees dev, but then still falls through to\natomisp_register_i2c_module(). This results in use-after-free.\nIf atomisp_register_i2c_module() fails, the media entity and control\nhandler are left initialized and dev is leaked.\ngc2235_remove() unconditionally calls media_entity_cleanup() and\nv4l2_ctrl_handler_free(), but these are not initialized at every\nerror path in gc2235_probe().\nReplace gc2235_remove() calls in the probe error paths with explicit\nunwind labels that free only the resources initialized at each point\nof failure, in reverse order of initialization.", "A flaw was found in the Linux kernel's media: atomisp: gc2235 module. This vulnerability arises from incorrect error handling during the module's initialization process. Specifically, a use-after-free (UAF) condition can occur, where the system attempts to use memory that has already been released, potentially allowing a local attacker to gain elevated privileges or cause the system to crash. Additionally, a memory leak can occur, consuming system resources and leading to a denial of service."], "name": "CVE-2026-80650", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80650\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80650\nhttps://lore.kernel.org/linux-cve-announce/2026082843-CVE-2026-80650-abdd@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a49d25364dfb9f8a64037488a39ab1f56c5fa419,fdbb8e55578b4ab647fa58827a9dd8730d7f4add)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a49d25364dfb9f8a64037488a39ab1f56c5fa419,d57e67ea48e4d095052f2b14d8dd7593621f862f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a49d25364dfb9f8a64037488a39ab1f56c5fa419,f614bf0a64aa1cb7444d152a96798a6bf1d49e1f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a49d25364dfb9f8a64037488a39ab1f56c5fa419,628f763aee0047ff44974388d6f70f75a763026b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.0,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.0,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.0,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T11:15:03.528958+00:00", "updated": "2026-09-02T05:30:08.144721+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}