The Linux kernel staging IPU7 media driver contains a use‑after‑free bug in its async notifier registration path. When a probe step fails after registering the async notifier, the driver cleans up the device but leaves the notifier registered in the global list while its owning structure is freed. Subsequent list traversals corrupt the notifier list and can trigger a kernel crash.

All Linux kernel releases that include the staging/ipu7 driver prior to the commit that removes the notifier cleanup are affected. Version information is not enumerated, so any system running an unpatched kernel could be vulnerable.

The CVSS score is 4.1, indicating a moderate severity. The EPSS score is less than 1%, indicating a very low but non‑zero exploitation attack vector is local; an attacker would need to cause the driver probe to fail, for example by interacting with the media subsystem. While the bug can lead to kernel crashes, there is no evidence of privilege escalation or remote exploitation.