CVE-2026-64447

CVE-2026-64447 is a double-free in the Intel IPU (Image Processing Unit) staging driver affecting the `ipu7_mmu_init()` and `ipu7_bus_add_device()` error paths. The bug occurs because both paths call `kfree(pdata)` after already calling `put_device()`, not recognizing that `put_device()` triggers `ipu7_bus_release()` — which takes ownership of and frees `pdata`. This is the classic auxiliary_device ownership transfer problem: upon successful return from `auxiliary_device_init()`, the installed release function owns the data, but error paths must NOT free it independently. There's a second bug layered on top: `dev_err_probe()` is called after the device is freed, creating a use-after-free where the diagnostic infrastructure dereferences memory that has already been deallocated. The fix requires two changes. First, save the return value (`ret`) before calling `put_device()` or `auxiliary_device_uninit()`. Second, remove the redundant `kfree(pdata)` from both error paths — the release function handles it. This isn't defensive programming; it's double-free creation. If you're auditing similar code, look for any driver that calls `put_device()` or `auxiliary_device_uninit()` in an error handler after having previously allocated `pdata`. The auxiliary_device API transfers ownership to the release function on successful initialization — error paths must not free data that has already been handed off. This pattern likely exists in other staging media drivers consuming the auxiliary_device API; the error paths are precisely the code paths least likely to receive thorough testing.

Reviewed through automated stages and approved by a human before publication.