CVE-2026-93070

A flaw was found in the ipu6 media driver of the Linux kernel. This vulnerability arises from incorrect handling of auxiliary device private data during initialization, leading to a double free condition. A local attacker could potentially exploit this to cause a denial of service or other memory corruption impacts.

A double free can occur in the Intel IPU6 media driver error paths after ipu6_bus_initialize_device transfers ownership of pdata to the auxiliary device. An MMU initialization failure or auxiliary device add failure can invoke the device release callback which frees pdata, while the caller subsequently frees the same object again. This is a local heap memory corruption issue that can at least cause a kernel crash. For the CVSS the PR:H because reliable triggering normally requires administrative control over the IPU6 PCI driver lifecycle or device reinitialization and access to a rare initialization failure path. No direct network attack vector is indicated. The paranoid impact considers potential confidentiality and integrity effects because a kernel heap double free is a memory corruption primitive, but privilege escalation is not demonstrated by the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.