The Linux kernel's NXP i.MX8 Image Signal Interface (imx8_isi) driver contains a use‑after‑free bug in __media_entity_remove_link(). The removal sequence frees media entity pads before links that reference them are removed, causing a slab-use‑after‑free (CWE-416) and improper resource cleanup (CWE-825). This memory corruption could lead the kernel to crash, and if attacker‑controlled data reallocates the freed memory the kernel could execute arbitrary code.

The flaw affects Linux kernel installations that include the imx8_isi module, which is employed on devices built around NXP i.MX8 System‑on‑Chip processors. Any distribution or custom kernel build that ships the unpatched module is vulnerable, regardless of the specific kernel version, until the upstream fix is merged and propagated.

The CVSS score of 7.8 points to a moderate to high severity. The EPSS score is below 1 % indicating a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The bug manifests when the imx8_isi module is unloaded, which normally requires root privileges to run rmmod; this prerequisite is inferred from the description. An attacker with the ability to unload the module could trigger a kernel panic (denial of service), and if attacker‑controlled data later occupies the freed memory there is a potential for kernel‑mode code execution. No exploitation has been documented to date.