CVE-2026-64447

In the Linux kernel, the following vulnerability has been resolved:

staging: media: ipu7: fix double-free and use-after-free in error paths

In both ipu7isysinit() and ipu7psysinit(), pdata is allocated and then passed to ipu7businitializedevice(), which stores it in adev->pdata. The ipu7bus_release() function frees adev->pdata when the device's reference count drops to zero.

Two error paths incorrectly call kfree(pdata) after the device teardown has already freed it:

1. When ipu7mmuinit() fails: putdevice() is called, which drops the reference count to zero and triggers ipu7bus_release() -> kfree(pdata). The subsequent kfree(pdata) is a double-free.

2. When ipu7busadddevice() fails: it calls auxiliarydeviceuninit() internally, which calls putdevice() -> ipu7busrelease() -> kfree(pdata). The subsequent kfree(pdata) is again a double-free.

Note that the kfree(pdata) when ipu7businitializedevice() itself fails is correct, because in that case auxiliarydevice_init() failed and the release function was never set up, so pdata must be freed manually.

Additionally, the error code was not saved before calling putdevice(), causing ERRCAST() to dereference the already-freed adev pointer when constructing the return value. Fix this by saving the error from deverrprobe() before putdevice() and returning ERRPTR() instead.

Remove the redundant kfree(pdata) calls and fix the use-after-free in the return values of the two affected error paths.