Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-89870

media: zoran: Avoid freeing a registered video_device twice

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered video_device twice zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that release callback, which kfree()s the video_device. zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device teardown could free the same video_device twice. Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the video_device was not registered there. This issue was found by a static analysis checker and confirmed by manual source review.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • bd01629315ffd5b63da91d0bd529a77d30e55028 to < 29792762e65d4eefbe75b6048c59763fd844191aaffected
  • ff3357bffd9fb78f59762d8955afc7382a279079 to < 99277a387802eb6c1907c73f09d746908cc64913affected
  • 82e3a496eb56da0b9f29fdc5b63cedb3289e91de to < 3ad6cf27505017a6794f5f96c31218c2291e951baffected
  • 82e3a496eb56da0b9f29fdc5b63cedb3289e91de to < c4acac8cdc005b2d14b6cef5e215d264212857f3affected
  • 82e3a496eb56da0b9f29fdc5b63cedb3289e91de to < 4d99d8d0d895489064783601a516bd45812fa992affected
  • 82e3a496eb56da0b9f29fdc5b63cedb3289e91de to < f1c4f3885df1f09bcab5296d86834d104f865e86affected
  • 82e3a496eb56da0b9f29fdc5b63cedb3289e91de to < 672dbccf4351370dad002d3c78dbb29ca1588f22affected
  • 82e3a496eb56da0b9f29fdc5b63cedb3289e91de to < 0735e0b5a96761a9ce277a238e834008ad92a0a5affected
  • c1ba65100a359fe28cfe37e09e10c99f247cbf1eaffected
  • 1e501ec38796f43e995731d1bcd4173cb1ccfce0affected
  • 5.10.110 to < 5.10.273affected
  • 5.15.33 to < 5.15.224affected
  • 5.16.19 to < 5.17affected
  • 5.17.2 to < 5.18affected

Linux Linux

Default version status: affected

  • 5.18affected
  • 0 to < 5.18unaffected
  • 5.10.273 to ≤ 5.10.*unaffected
  • 5.15.224 to ≤ 5.15.*unaffected
  • 6.1.188 to ≤ 6.1.*unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.51 to ≤ 6.18.*unaffected
  • 7.2.5 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References