CVE-2026-89877 (GCVE-0-2026-89877)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39
VLAI
Title
media: saa7164: fix cleanup on resource allocation failure
Summary
In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. If get_resources() fails, saa7164_dev_setup() decrements the device count and returns an error, but leaves the device on saa7164_devlist. The probe error path then frees the device, leaving a dangling entry on the global list. Reuse the existing MMIO mapping error path to remove the device from saa7164_devlist and decrement the device count before returning. Also release BAR0 if it was successfully requested but the BAR2 request fails.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 443c1228d50518f3c550e1fef490a2c9d9246ce7 , < daa5b32cdf7db81a07ee2a91ce092a363e7754aa (git)
Affected: 443c1228d50518f3c550e1fef490a2c9d9246ce7 , < 77f216f8de6221efb6f6c471bc9e598f1879825b (git)
Affected: 443c1228d50518f3c550e1fef490a2c9d9246ce7 , < 69259c627009bf7621010ae9e997dad2dad3339c (git)
Affected: 443c1228d50518f3c550e1fef490a2c9d9246ce7 , < 4d2048466af9e2c960c5be6dcd317e3b657d268b (git)
Affected: 443c1228d50518f3c550e1fef490a2c9d9246ce7 , < fc65623524b5bf23baddc6ae688d954fba0d5de2 (git)
Affected: 443c1228d50518f3c550e1fef490a2c9d9246ce7 , < 28e84c6e2e6753ed238ea097b2842a32a6a6879b (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.32
Unaffected: 0 , < 2.6.32 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/saa7164/saa7164-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "daa5b32cdf7db81a07ee2a91ce092a363e7754aa",
              "status": "affected",
              "version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
              "versionType": "git"
            },
            {
              "lessThan": "77f216f8de6221efb6f6c471bc9e598f1879825b",
              "status": "affected",
              "version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
              "versionType": "git"
            },
            {
              "lessThan": "69259c627009bf7621010ae9e997dad2dad3339c",
              "status": "affected",
              "version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
              "versionType": "git"
            },
            {
              "lessThan": "4d2048466af9e2c960c5be6dcd317e3b657d268b",
              "status": "affected",
              "version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
              "versionType": "git"
            },
            {
              "lessThan": "fc65623524b5bf23baddc6ae688d954fba0d5de2",
              "status": "affected",
              "version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
              "versionType": "git"
            },
            {
              "lessThan": "28e84c6e2e6753ed238ea097b2842a32a6a6879b",
              "status": "affected",
              "version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/saa7164/saa7164-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.32"
            },
            {
              "lessThan": "2.6.32",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: saa7164: fix cleanup on resource allocation failure\n\nsaa7164_dev_setup() adds the device to the global saa7164_devlist before\nrequesting the PCI BAR memory regions.\n\nIf get_resources() fails, saa7164_dev_setup() decrements the device count\nand returns an error, but leaves the device on saa7164_devlist. The probe\nerror path then frees the device, leaving a dangling entry on the global\nlist.\n\nReuse the existing MMIO mapping error path to remove the device from\nsaa7164_devlist and decrement the device count before returning.\n\nAlso release BAR0 if it was successfully requested but the BAR2 request\nfails."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only from saa7164 PCI probe (saa7164_initdev \u2192 saa7164_dev_setup \u2192 get_resources()) on a locally attached NXP SAA7164/Hauppauge HVR card; PVR, HTPC, and broadcast systems enumerate that function at boot, udev bind, or PCI/Thunderbolt hotplug, which is a local PCI probe path, not a network or USB protocol path.\nAC:L - A 1131:7164 function whose BAR0 or BAR2 cannot be reserved (zero-length BAR, overlap with busy iomem, or BAR2 failing after BAR0 was claimed) makes get_resources() return -EBUSY on every probe, so the dangling saa7164_devlist UAF is deterministic with no race or layout lottery the attacker cannot influence.\nPR:N - saa7164_initdev() performs no capability or authentication checks; when a matching PCI function appears, kernel enumeration and udev module autoload run the failing get_resources() path automatically without an OS account or user-namespace privilege.\nUI:N - Probe is invoked automatically by the PCI core and udev-driven module autoload on device enumeration; no victim must open a V4L/DVB node, load firmware, or otherwise interact.\nS:U - The dangling saa7164_devlist pointer and follow-on use-after-free remain inside the host kernel saa7164 driver and do not cross a VM, IOMMU, or sandbox security boundary.\nC:H - After kfree(dev) the global saa7164_devlist still points at the freed saa7164_dev; debugfs seq_start/seq_show and later probes walk that object, so reclaimed heap contents including kernel pointers can be read back \u2014 a use-after-free read primitive.\nI:H - The next list_add_tail() or list_del() on saa7164_devlist writes next/prev through the freed list node, corrupting whatever slab object reused that allocation and enabling an arbitrary kernel write and control-flow hijack.\nA:H - Walking or mutating the dangling saa7164_devlist entry after kfree causes a kernel oops or panic via poisoned-slab dereference or list corruption, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:30.609Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/daa5b32cdf7db81a07ee2a91ce092a363e7754aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/77f216f8de6221efb6f6c471bc9e598f1879825b"
        },
        {
          "url": "https://git.kernel.org/stable/c/69259c627009bf7621010ae9e997dad2dad3339c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d2048466af9e2c960c5be6dcd317e3b657d268b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc65623524b5bf23baddc6ae688d954fba0d5de2"
        },
        {
          "url": "https://git.kernel.org/stable/c/28e84c6e2e6753ed238ea097b2842a32a6a6879b"
        }
      ],
      "title": "media: saa7164: fix cleanup on resource allocation failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89877",
    "datePublished": "2026-09-16T10:31:44.194Z",
    "dateReserved": "2026-09-11T19:38:34.772Z",
    "dateUpdated": "2026-09-16T14:39:30.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89877",
      "date": "2026-09-25",
      "epss": "0.00196",
      "percentile": "0.0824"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/pci/saa7164/saa7164-core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "daa5b32cdf7db81a07ee2a91ce092a363e7754aa",
                    "status": "affected",
                    "version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "77f216f8de6221efb6f6c471bc9e598f1879825b",
                    "status": "affected",
                    "version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "69259c627009bf7621010ae9e997dad2dad3339c",
                    "status": "affected",
                    "version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4d2048466af9e2c960c5be6dcd317e3b657d268b",
                    "status": "affected",
                    "version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fc65623524b5bf23baddc6ae688d954fba0d5de2",
                    "status": "affected",
                    "version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "28e84c6e2e6753ed238ea097b2842a32a6a6879b",
                    "status": "affected",
                    "version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/pci/saa7164/saa7164-core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.32"
                  },
                  {
                    "lessThan": "2.6.32",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: saa7164: fix cleanup on resource allocation failure\n\nsaa7164_dev_setup() adds the device to the global saa7164_devlist before\nrequesting the PCI BAR memory regions.\n\nIf get_resources() fails, saa7164_dev_setup() decrements the device count\nand returns an error, but leaves the device on saa7164_devlist. The probe\nerror path then frees the device, leaving a dangling entry on the global\nlist.\n\nReuse the existing MMIO mapping error path to remove the device from\nsaa7164_devlist and decrement the device count before returning.\n\nAlso release BAR0 if it was successfully requested but the BAR2 request\nfails."
          }
        ],
        "id": "CVE-2026-89877",
        "lastModified": "2026-09-16T15:18:14.570",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:55.987",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/28e84c6e2e6753ed238ea097b2842a32a6a6879b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4d2048466af9e2c960c5be6dcd317e3b657d268b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/69259c627009bf7621010ae9e997dad2dad3339c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/77f216f8de6221efb6f6c471bc9e598f1879825b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/daa5b32cdf7db81a07ee2a91ce092a363e7754aa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fc65623524b5bf23baddc6ae688d954fba0d5de2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.