In the Linux kernel, the NXP i.MX8 Image Signal Interface (imx8_isi) driver contains a use‑after‑free bug in the function __media_entity_remove_link(). When the module is removed, the driver frees media entity pads before removing the corresponding links, leaving dangling references that KASAN reports as a slab-use-after-free. The resulting kernel memory corruption can cause a kernel panic or, if an attacker can supply malicious data that is subsequently used in the freed memory, arbitrary kernel‑space code execution. The weakness is improper resource cleanup (CWE‑825).

The flaw affects Linux kernel installations that include the imx8_isi driver, which is used on devices built around NXP i.MX8 System‑on‑Chip processors. Any distro or custom build that ships the unpatched module is vulnerable, regardless of the specific kernel release, until the upstream fix is incorporated.

The EPSS score is below 1 %, indicating a very low probability of exploitation in the wild, and the vulnerability does not appear in CISA’s KEV catalog. The flaw is triggered when the imx8_isi module is removed, which normally requires root privileges; this inference comes from the need to run rmmod. An attacker who can unload the module could lead the kernel into a crash (denial of service) or, if the memory is reused maliciously, obtain code execution in kernel mode. No CVSS score is supplied, but the use‑after‑free in a critical kernel component suggests a high potential impact.