The Linux kernel ipu7 media staging driver had a vulnerability where in the functions ipu7_isys_init() and ipu7_psys_init(), the pdata structure was freed twice in certain error paths due to redundant kfree() calls after device teardown had already freed the memory. Additionally, the error code was not saved before calling put_device(), causing a use-after-free when constructing the return value with ERR_CAST(). The fix involved removing redundant kfree() calls and saving the error code before put_device() to prevent dereferencing freed memory.

The vulnerability could lead to double-free and use-after-free conditions in kernel space, which may cause system instability or crashes. There is no information about exploitation in the wild or further impact such as privilege escalation.

A fix for this vulnerability has been implemented in the Linux kernel. Since no explicit patch links or vendor advisories are provided, check the official Linux kernel repositories or vendor advisories for the fixed versions and apply updates accordingly. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.