---
id: CVE-2026-80650
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: atomisp: gc2235: fix UAF and memory leak

  gc2235_probe() handles its error paths incorrectly.

  If media_entity_pads_init() fails, gc2235_remove() is called, whic…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: atomisp: gc2235: fix UAF and memory leak

  gc2235_probe() handles its error paths incorrectly.

  If media_entity_pads_init() fails, gc2235_remove() is called, whic…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a49d25364dfb9f8a64037488a39ab1f56c5fa419 <
    51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654
  - >-
    Linux >= ad85094b293e40e7a2f831b0311a389d952ebd5e <
    fdbb8e55578b4ab647fa58827a9dd8730d7f4add
  - >-
    Linux >= ad85094b293e40e7a2f831b0311a389d952ebd5e <
    d57e67ea48e4d095052f2b14d8dd7593621f862f
  - >-
    Linux >= ad85094b293e40e7a2f831b0311a389d952ebd5e <
    f614bf0a64aa1cb7444d152a96798a6bf1d49e1f
  - >-
    Linux >= ad85094b293e40e7a2f831b0311a389d952ebd5e <
    628f763aee0047ff44974388d6f70f75a763026b
  - Linux 4.12
  - Linux 5.8
published: '2026-08-28'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T06:16:58.960'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80650'
references:
  - url: 'https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/628f763aee0047ff44974388d6f70f75a763026b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d57e67ea48e4d095052f2b14d8dd7593621f862f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f614bf0a64aa1cb7444d152a96798a6bf1d49e1f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fdbb8e55578b4ab647fa58827a9dd8730d7f4add'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00209
epssPercentile: 0.09988
ingestedAt: '2026-10-05T06:13:49.199Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: atomisp: gc2235: fix UAF and memory leak

gc2235_probe() handles its error paths incorrectly.

If media_entity_pads_init() fails, gc2235_remove() is called, which
tears down the subdev and frees dev, but then still falls through to
atomisp_register_i2c_module(). This results in use-after-free.

If atomisp_register_i2c_module() fails, the media entity and control
handler are left initialized and dev is leaked.

gc2235_remove() unconditionally calls media_entity_cleanup() and
v4l2_ctrl_handler_free(), but these are not initialized at every
error path in gc2235_probe().

Replace gc2235_remove() calls in the probe error paths with explicit
unwind labels that free only the resources initialized at each point
of failure, in reverse order of initialization.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.