CVE-2026-89870

media: zoran: Avoid freeing a registered video_device twice

State: Published
Severity: 7.8 High
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: zoran: Avoid freeing a registered video_device twice

zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that release callback, which kfree()s the video_device.

zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device teardown could free the same video_device twice.

Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the video_device was not registered there.

This issue was found by a static analysis checker and confirmed by manual source review.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bd01629315ffd5b63da91d0bd529a77d30e55028 to before 29792762e65d4eefbe75b6048c59763fd844191aAffected ff3357bffd9fb78f59762d8955afc7382a279079 to before 99277a387802eb6c1907c73f09d746908cc64913Affected 82e3a496eb56da0b9f29fdc5b63cedb3289e91de to before 3ad6cf27505017a6794f5f96c31218c2291e951bAffected 82e3a496eb56da0b9f29fdc5b63cedb3289e91de to before c4acac8cdc005b2d14b6cef5e215d264212857f3Affected 82e3a496eb56da0b9f29fdc5b63cedb3289e91de to before 4d99d8d0d895489064783601a516bd45812fa992Affected 82e3a496eb56da0b9f29fdc5b63cedb3289e91de to before f1c4f3885df1f09bcab5296d86834d104f865e86Affected 82e3a496eb56da0b9f29fdc5b63cedb3289e91de to before 672dbccf4351370dad002d3c78dbb29ca1588f22Affected 82e3a496eb56da0b9f29fdc5b63cedb3289e91de to before 0735e0b5a96761a9ce277a238e834008ad92a0a5Affected c1ba65100a359fe28cfe37e09e10c99f247cbf1eAffected 1e501ec38796f43e995731d1bcd4173cb1ccfce0Affected 5.10.110 to before 5.10.273Affected 5.15.33 to before 5.15.224Affected 5.16.19 to before 5.17Affected 5.17.2 to before 5.18Affected
LinuxLinux	5.18Affected before 5.18Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

bd01629315ffd5b63da91d0bd529a77d30e55028 to before 29792762e65d4eefbe75b6048c59763fd844191aAffected
ff3357bffd9fb78f59762d8955afc7382a279079 to before 99277a387802eb6c1907c73f09d746908cc64913Affected
82e3a496eb56da0b9f29fdc5b63cedb3289e91de to before 3ad6cf27505017a6794f5f96c31218c2291e951bAffected
82e3a496eb56da0b9f29fdc5b63cedb3289e91de to before c4acac8cdc005b2d14b6cef5e215d264212857f3Affected
82e3a496eb56da0b9f29fdc5b63cedb3289e91de to before 4d99d8d0d895489064783601a516bd45812fa992Affected
82e3a496eb56da0b9f29fdc5b63cedb3289e91de to before f1c4f3885df1f09bcab5296d86834d104f865e86Affected
82e3a496eb56da0b9f29fdc5b63cedb3289e91de to before 672dbccf4351370dad002d3c78dbb29ca1588f22Affected
82e3a496eb56da0b9f29fdc5b63cedb3289e91de to before 0735e0b5a96761a9ce277a238e834008ad92a0a5Affected
c1ba65100a359fe28cfe37e09e10c99f247cbf1eAffected
1e501ec38796f43e995731d1bcd4173cb1ccfce0Affected
5.10.110 to before 5.10.273Affected
5.15.33 to before 5.15.224Affected
5.16.19 to before 5.17Affected
5.17.2 to before 5.18Affected

LinuxLinux

5.18Affected
before 5.18Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.