CVE-2026-89870 (GCVE-0-2026-89870)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39
VLAI
Title
media: zoran: Avoid freeing a registered video_device twice
Summary
In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered video_device twice zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that release callback, which kfree()s the video_device. zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device teardown could free the same video_device twice. Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the video_device was not registered there. This issue was found by a static analysis checker and confirmed by manual source review.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 82e3a496eb56da0b9f29fdc5b63cedb3289e91de , < 3ad6cf27505017a6794f5f96c31218c2291e951b (git)
Affected: 82e3a496eb56da0b9f29fdc5b63cedb3289e91de , < c4acac8cdc005b2d14b6cef5e215d264212857f3 (git)
Affected: 82e3a496eb56da0b9f29fdc5b63cedb3289e91de , < 4d99d8d0d895489064783601a516bd45812fa992 (git)
Affected: 82e3a496eb56da0b9f29fdc5b63cedb3289e91de , < f1c4f3885df1f09bcab5296d86834d104f865e86 (git)
Affected: 82e3a496eb56da0b9f29fdc5b63cedb3289e91de , < 672dbccf4351370dad002d3c78dbb29ca1588f22 (git)
Affected: 82e3a496eb56da0b9f29fdc5b63cedb3289e91de , < 0735e0b5a96761a9ce277a238e834008ad92a0a5 (git)
Affected: bd01629315ffd5b63da91d0bd529a77d30e55028 (git)
Affected: ff3357bffd9fb78f59762d8955afc7382a279079 (git)
Affected: c1ba65100a359fe28cfe37e09e10c99f247cbf1e (git)
Affected: 1e501ec38796f43e995731d1bcd4173cb1ccfce0 (git)
Affected: 5.10.110 , < 5.11 (semver)
Affected: 5.15.33 , < 5.16 (semver)
Affected: 5.16.19 , < 5.17 (semver)
Affected: 5.17.2 , < 5.18 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/zoran/zoran_card.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3ad6cf27505017a6794f5f96c31218c2291e951b",
              "status": "affected",
              "version": "82e3a496eb56da0b9f29fdc5b63cedb3289e91de",
              "versionType": "git"
            },
            {
              "lessThan": "c4acac8cdc005b2d14b6cef5e215d264212857f3",
              "status": "affected",
              "version": "82e3a496eb56da0b9f29fdc5b63cedb3289e91de",
              "versionType": "git"
            },
            {
              "lessThan": "4d99d8d0d895489064783601a516bd45812fa992",
              "status": "affected",
              "version": "82e3a496eb56da0b9f29fdc5b63cedb3289e91de",
              "versionType": "git"
            },
            {
              "lessThan": "f1c4f3885df1f09bcab5296d86834d104f865e86",
              "status": "affected",
              "version": "82e3a496eb56da0b9f29fdc5b63cedb3289e91de",
              "versionType": "git"
            },
            {
              "lessThan": "672dbccf4351370dad002d3c78dbb29ca1588f22",
              "status": "affected",
              "version": "82e3a496eb56da0b9f29fdc5b63cedb3289e91de",
              "versionType": "git"
            },
            {
              "lessThan": "0735e0b5a96761a9ce277a238e834008ad92a0a5",
              "status": "affected",
              "version": "82e3a496eb56da0b9f29fdc5b63cedb3289e91de",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bd01629315ffd5b63da91d0bd529a77d30e55028",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ff3357bffd9fb78f59762d8955afc7382a279079",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c1ba65100a359fe28cfe37e09e10c99f247cbf1e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1e501ec38796f43e995731d1bcd4173cb1ccfce0",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.110",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "5.17.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/zoran/zoran_card.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.110",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: zoran: Avoid freeing a registered video_device twice\n\nzoran_init_video_device() installs zoran_vdev_release() as the\nvideo_device release callback through zoran_template. After\nvideo_register_device() succeeds, video_unregister_device() drops the\nregistered video_device reference and the V4L2 core eventually invokes\nthat release callback, which kfree()s the video_device.\n\nzoran_exit_video_devices() called video_unregister_device() and then\nkfree(zr-\u003evideo_dev), so device teardown could free the same\nvideo_device twice.\n\nRemove the direct kfree() and clear the cached pointer after\nunregistering. The pre-registration failure path keeps its manual free\nbecause the video_device was not registered there.\n\nThis issue was found by a static analysis checker and confirmed by\nmanual source review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The double-free is in zoran_exit_video_devices() on the ZR36057/36067 PCI MJPEG capture driver\u0027s zoran_remove() path (rmmod zr36067, PCI sysfs unbind, or hot-remove). It is reached from local driver teardown, not from network packets or a remote protocol.\nAC:L - After a successful probe, zoran_remove() always calls video_unregister_device() then kfree(zr-\u003evideo_dev). With no open fds, v4l2_device_release() already kfree\u0027s via zoran_vdev_release, so the second kfree is a deterministic double-free. With an fd held, the extra kfree is a deterministic UAF. No attacker-uncontrollable race or layout is required.\nPR:L - v4l2_open() has no capable() check; udev typically grants /dev/video* to the video group or seated uaccess user on capture/surveillance hosts (e.g. AverMedia 6 Eyes). Per CNA driver-removal UAF precedent, an unprivileged local user can hold the node and spray the freed video_device while teardown proceeds; init-namespace root is not required.\nUI:N - No victim action such as mounting a filesystem is required; the attacker opens /dev/video themselves and coordinates with driver removal (unbind/rmmod/maintenance). CNA driver-removal UAFs score UI:N.\nS:U - The double-free/UAF corrupts the host kernel slab object struct video_device. Any privilege escalation remains in the same kernel; this is not a VM/IOMMU boundary bypass.\nC:H - Double-free/UAF of struct video_device lets an attacker reclaim the slab object and read leftover kernel pointers/object state via subsequent ioctl/mmap on a still-open /dev/video fd, so confidentiality is High.\nI:H - struct video_device embeds fops, ioctl_ops, and a release callback; reclaiming the freed object enables function-pointer overwrite and control-flow hijacking, so integrity is High.\nA:H - A kernel double-free of video_device causes an oops/panic on the second kfree or on use of the dangling device, so availability is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:26.773Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3ad6cf27505017a6794f5f96c31218c2291e951b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4acac8cdc005b2d14b6cef5e215d264212857f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d99d8d0d895489064783601a516bd45812fa992"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1c4f3885df1f09bcab5296d86834d104f865e86"
        },
        {
          "url": "https://git.kernel.org/stable/c/672dbccf4351370dad002d3c78dbb29ca1588f22"
        },
        {
          "url": "https://git.kernel.org/stable/c/0735e0b5a96761a9ce277a238e834008ad92a0a5"
        }
      ],
      "title": "media: zoran: Avoid freeing a registered video_device twice",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89870",
    "datePublished": "2026-09-16T10:31:39.271Z",
    "dateReserved": "2026-09-11T19:38:34.771Z",
    "dateUpdated": "2026-09-16T14:39:26.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89870",
      "date": "2026-09-25",
      "epss": "0.00176",
      "percentile": "0.06311"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:41:50.000Z",
      "cve": "CVE-2026-89870",
      "id": "msrc_CVE-2026-89870",
      "initial_release_date": "2026-09-17T01:10:21.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "media: zoran: Avoid freeing a registered video_device twice",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89870.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/pci/zoran/zoran_card.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3ad6cf27505017a6794f5f96c31218c2291e951b",
                    "status": "affected",
                    "version": "82e3a496eb56da0b9f29fdc5b63cedb3289e91de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c4acac8cdc005b2d14b6cef5e215d264212857f3",
                    "status": "affected",
                    "version": "82e3a496eb56da0b9f29fdc5b63cedb3289e91de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4d99d8d0d895489064783601a516bd45812fa992",
                    "status": "affected",
                    "version": "82e3a496eb56da0b9f29fdc5b63cedb3289e91de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f1c4f3885df1f09bcab5296d86834d104f865e86",
                    "status": "affected",
                    "version": "82e3a496eb56da0b9f29fdc5b63cedb3289e91de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "672dbccf4351370dad002d3c78dbb29ca1588f22",
                    "status": "affected",
                    "version": "82e3a496eb56da0b9f29fdc5b63cedb3289e91de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0735e0b5a96761a9ce277a238e834008ad92a0a5",
                    "status": "affected",
                    "version": "82e3a496eb56da0b9f29fdc5b63cedb3289e91de",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "bd01629315ffd5b63da91d0bd529a77d30e55028",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "ff3357bffd9fb78f59762d8955afc7382a279079",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "c1ba65100a359fe28cfe37e09e10c99f247cbf1e",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "1e501ec38796f43e995731d1bcd4173cb1ccfce0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "affected",
                    "version": "5.10.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "affected",
                    "version": "5.15.33",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.17",
                    "status": "affected",
                    "version": "5.16.19",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "affected",
                    "version": "5.17.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/pci/zoran/zoran_card.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: zoran: Avoid freeing a registered video_device twice\n\nzoran_init_video_device() installs zoran_vdev_release() as the\nvideo_device release callback through zoran_template. After\nvideo_register_device() succeeds, video_unregister_device() drops the\nregistered video_device reference and the V4L2 core eventually invokes\nthat release callback, which kfree()s the video_device.\n\nzoran_exit_video_devices() called video_unregister_device() and then\nkfree(zr-\u003evideo_dev), so device teardown could free the same\nvideo_device twice.\n\nRemove the direct kfree() and clear the cached pointer after\nunregistering. The pre-registration failure path keeps its manual free\nbecause the video_device was not registered there.\n\nThis issue was found by a static analysis checker and confirmed by\nmanual source review."
          }
        ],
        "id": "CVE-2026-89870",
        "lastModified": "2026-09-16T15:18:14.187",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:55.153",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0735e0b5a96761a9ce277a238e834008ad92a0a5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3ad6cf27505017a6794f5f96c31218c2291e951b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4d99d8d0d895489064783601a516bd45812fa992"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/672dbccf4351370dad002d3c78dbb29ca1588f22"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c4acac8cdc005b2d14b6cef5e215d264212857f3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f1c4f3885df1f09bcab5296d86834d104f865e86"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.