CVE-2026-89887 (GCVE-0-2026-89887)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39
VLAI
Title
media: i2c: ov7740: fix use-after-destroy in remove
Summary
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, but then called ov7740_free_controls() which invokes both of them a second time, resulting in a double-free. This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740_free_controls() to safely tear down the mutex and control handler in the correct order.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 39c5c4471b8d793daf868bd004e56ed420e89707 , < 9e4693436c7dcf8584002500ce4b434b79bbf9ed (git)
Affected: 39c5c4471b8d793daf868bd004e56ed420e89707 , < 81e9765878d3ac8ad18e3a683332b5d6bc3a0e33 (git)
Affected: 39c5c4471b8d793daf868bd004e56ed420e89707 , < 8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e (git)
Affected: 39c5c4471b8d793daf868bd004e56ed420e89707 , < 7512838a19af0a284a58435292243fad21e57ff1 (git)
Affected: 39c5c4471b8d793daf868bd004e56ed420e89707 , < 25e2505866c577db2661e4d431f0907c6ec9a3b4 (git)
Affected: 39c5c4471b8d793daf868bd004e56ed420e89707 , < af81f35e4f429e769b784754e1aa4d7a922470ac (git)
Affected: 39c5c4471b8d793daf868bd004e56ed420e89707 , < 09453b467990e8ef8fe09f45a685f9a625248d33 (git)
Affected: 39c5c4471b8d793daf868bd004e56ed420e89707 , < 5d1b3dea5a44124bab6c14a2d71b977dabed54e7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/i2c/ov7740.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9e4693436c7dcf8584002500ce4b434b79bbf9ed",
              "status": "affected",
              "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
              "versionType": "git"
            },
            {
              "lessThan": "81e9765878d3ac8ad18e3a683332b5d6bc3a0e33",
              "status": "affected",
              "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
              "versionType": "git"
            },
            {
              "lessThan": "8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e",
              "status": "affected",
              "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
              "versionType": "git"
            },
            {
              "lessThan": "7512838a19af0a284a58435292243fad21e57ff1",
              "status": "affected",
              "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
              "versionType": "git"
            },
            {
              "lessThan": "25e2505866c577db2661e4d431f0907c6ec9a3b4",
              "status": "affected",
              "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
              "versionType": "git"
            },
            {
              "lessThan": "af81f35e4f429e769b784754e1aa4d7a922470ac",
              "status": "affected",
              "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
              "versionType": "git"
            },
            {
              "lessThan": "09453b467990e8ef8fe09f45a685f9a625248d33",
              "status": "affected",
              "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
              "versionType": "git"
            },
            {
              "lessThan": "5d1b3dea5a44124bab6c14a2d71b977dabed54e7",
              "status": "affected",
              "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/i2c/ov7740.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ov7740: fix use-after-destroy in remove\n\nThe ov7740_remove() function had a severe teardown order bug where it\ndestroyed the driver\u0027s mutex before freeing the V4L2 control handler\nwhich relies on that mutex, leading to a use-after-destroy kernel panic.\nFurthermore, the driver explicitly called v4l2_ctrl_handler_free() and\nmutex_destroy() sequentially, but then called ov7740_free_controls()\nwhich invokes both of them a second time, resulting in a double-free.\n\nThis patch fixes the issue by unregistering the subdevice first, and\nrelying exclusively on ov7740_free_controls() to safely tear down the\nmutex and control handler in the correct order."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in ov7740_remove() for the onboard OmniVision OV7740 I2C/CSI camera sensor, reached via local I2C teardown (sysfs unbind, i2c delete_device, rmmod) and V4L2 ioctls on /dev/v4l-subdev* (V4L2_SUBDEV_FL_HAS_DEVNODE). No network, Bluetooth, or USB packet path exists.\nAC:L - ov7740_remove() deterministically mutex_destroy()s ov7740-\u003emutex then v4l2_ctrl_handler_free() locks that same mutex and kvfree()s all v4l2_ctrl objects while the subdev is still registered. An attacker holding the node and driving teardown needs no uncontrollable race or rare debug config.\nPR:L - VIDIOC_G/S_CTRL on the subdev node have no capable() check; udev typically grants /dev/v4l-subdev* to the video group or Android camera UID on SAMA5/embedded boards shipping CONFIG_VIDEO_OV7740. Per CNA driver-removal UAF and media i2c unbind precedent this is PR:L, not init-namespace root.\nUI:N - The attacker opens the V4L2 subdev node and initiates or coordinates driver teardown themselves (unbind/rmmod/maintenance). CNA driver-removal UAFs score UI:N; no separate victim action such as mounting a filesystem is required.\nS:U - The UAF corrupts host kernel heap (struct v4l2_ctrl, v4l2_ctrl_ref, and handler buckets) within the same OS security authority. It is not a VM escape, IOMMU/DMA isolation bypass, or sandbox breakout.\nC:H - v4l2_ctrl_handler_free() kvfree()s each v4l2_ctrl while open fds still hold vfh-\u003ectrl_handler and issue VIDIOC_G_CTRL/G_EXT_CTRLS through dangling ctrl lists. Per kernel UAF guidance this enables arbitrary kernel disclosure, so confidentiality is High.\nI:H - struct v4l2_ctrl embeds ops and type_ops function pointers; VIDIOC_S_CTRL on a sprayed freed object yields control-flow hijack. Kernel UAF guidance scores this High integrity.\nA:H - mutex_lock of the destroyed mutex and later walks of freed ctrl lists after handler_free oops or panic the kernel even when the UAF is not fully turned into a write primitive, so availability is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:37.116Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9e4693436c7dcf8584002500ce4b434b79bbf9ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/81e9765878d3ac8ad18e3a683332b5d6bc3a0e33"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7512838a19af0a284a58435292243fad21e57ff1"
        },
        {
          "url": "https://git.kernel.org/stable/c/25e2505866c577db2661e4d431f0907c6ec9a3b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/af81f35e4f429e769b784754e1aa4d7a922470ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/09453b467990e8ef8fe09f45a685f9a625248d33"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d1b3dea5a44124bab6c14a2d71b977dabed54e7"
        }
      ],
      "title": "media: i2c: ov7740: fix use-after-destroy in remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89887",
    "datePublished": "2026-09-16T10:31:51.195Z",
    "dateReserved": "2026-09-11T19:38:34.773Z",
    "dateUpdated": "2026-09-16T14:39:37.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89887",
      "date": "2026-09-25",
      "epss": "0.00176",
      "percentile": "0.06313"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:36:41.000Z",
      "cve": "CVE-2026-89887",
      "id": "msrc_CVE-2026-89887",
      "initial_release_date": "2026-09-17T01:07:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "media: i2c: ov7740: fix use-after-destroy in remove",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89887.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/i2c/ov7740.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9e4693436c7dcf8584002500ce4b434b79bbf9ed",
                    "status": "affected",
                    "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "81e9765878d3ac8ad18e3a683332b5d6bc3a0e33",
                    "status": "affected",
                    "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e",
                    "status": "affected",
                    "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7512838a19af0a284a58435292243fad21e57ff1",
                    "status": "affected",
                    "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "25e2505866c577db2661e4d431f0907c6ec9a3b4",
                    "status": "affected",
                    "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "af81f35e4f429e769b784754e1aa4d7a922470ac",
                    "status": "affected",
                    "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "09453b467990e8ef8fe09f45a685f9a625248d33",
                    "status": "affected",
                    "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5d1b3dea5a44124bab6c14a2d71b977dabed54e7",
                    "status": "affected",
                    "version": "39c5c4471b8d793daf868bd004e56ed420e89707",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/i2c/ov7740.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.16"
                  },
                  {
                    "lessThan": "4.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ov7740: fix use-after-destroy in remove\n\nThe ov7740_remove() function had a severe teardown order bug where it\ndestroyed the driver\u0027s mutex before freeing the V4L2 control handler\nwhich relies on that mutex, leading to a use-after-destroy kernel panic.\nFurthermore, the driver explicitly called v4l2_ctrl_handler_free() and\nmutex_destroy() sequentially, but then called ov7740_free_controls()\nwhich invokes both of them a second time, resulting in a double-free.\n\nThis patch fixes the issue by unregistering the subdevice first, and\nrelying exclusively on ov7740_free_controls() to safely tear down the\nmutex and control handler in the correct order."
          }
        ],
        "id": "CVE-2026-89887",
        "lastModified": "2026-09-16T15:18:15.230",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:57.210",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/09453b467990e8ef8fe09f45a685f9a625248d33"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/25e2505866c577db2661e4d431f0907c6ec9a3b4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5d1b3dea5a44124bab6c14a2d71b977dabed54e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7512838a19af0a284a58435292243fad21e57ff1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/81e9765878d3ac8ad18e3a683332b5d6bc3a0e33"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9e4693436c7dcf8584002500ce4b434b79bbf9ed"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/af81f35e4f429e769b784754e1aa4d7a922470ac"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.