From: David Heidelberg The subdevice release callback frees the memory that contains the v4l2_subdev structure itself, but v4l2_subdev_release() wrote sd->devnode = NULL after invoking the callback. Any driver implementing the release callback to free its state would leave that write targeting already-freed memory. Clear sd->devnode before calling the release callback so the callback runs last, matching its documented purpose of freeing the subdevice memory. Fixes: 6990570f7e0a ("media: v4l2-core: fix a use-after-free bug of sd->devnode") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: David Heidelberg --- drivers/media/v4l2-core/v4l2-device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/v4l2-core/v4l2-device.c b/drivers/media/v4l2-core/v4l2-device.c index 67e3073de1321..b4036105c2d1a 100644 --- a/drivers/media/v4l2-core/v4l2-device.c +++ b/drivers/media/v4l2-core/v4l2-device.c @@ -171,19 +171,19 @@ int __v4l2_device_register_subdev(struct v4l2_device *v4l2_dev, return err; } EXPORT_SYMBOL_GPL(__v4l2_device_register_subdev); static void v4l2_subdev_release(struct v4l2_subdev *sd) { struct module *owner = !sd->owner_v4l2_dev ? sd->owner : NULL; + sd->devnode = NULL; if (sd->internal_ops && sd->internal_ops->release) sd->internal_ops->release(sd); - sd->devnode = NULL; module_put(owner); } static void v4l2_device_release_subdev_node(struct video_device *vdev) { v4l2_subdev_release(video_get_drvdata(vdev)); kfree(vdev); } --- base-commit: 7079a12d7506b07fb53b54a664bfad5fa9b16d70 change-id: 20260917-v4l2-release-fix-89094967bc9d Best regards, -- David Heidelberg