CVE-2026-80650

In the Linux kernel, the following vulnerability has been resolved:

media: atomisp: gc2235: fix UAF and memory leak

gc2235_probe() handles its error paths incorrectly.

If mediaentitypadsinit() fails, gc2235remove() is called, which tears down the subdev and frees dev, but then still falls through to atomispregisteri2c_module(). This results in use-after-free.

If atomispregisteri2c_module() fails, the media entity and control handler are left initialized and dev is leaked.

gc2235remove() unconditionally calls mediaentitycleanup() and v4l2ctrlhandlerfree(), but these are not initialized at every error path in gc2235_probe().

Replace gc2235_remove() calls in the probe error paths with explicit unwind labels that free only the resources initialized at each point of failure, in reverse order of initialization.