CVE-2026-89870: media: zoran: Avoid freeing a registered video_device twice

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered video_device twice zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that release callback, which kfree()s the video_device. zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device teardown could free the same video_device twice. Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the video_device was not registered there. This issue was found by a static analysis checker and confirmed by manual source review.

Affected products

Linux: from 5.10.110 before 5.10.273; from 5.15.33 before 5.15.224; from 5.16.19 before 5.17; from 5.17.2 before 5.18 — fixed in 5.10.273, 5.15.224, 5.17, 5.18

How to fix

Upgrade to a fixed version: Linux 5.10.273, 5.15.224, 5.17, 5.18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-89870 or the next vulnerability affects your stack