CVE-2026-89870 (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered video_device twice zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that release callback, which kfree()s the video_device. zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device teardown could free the same video_device twice. Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the video_device was not registered there. This issue was found by a static analysis checker and confirmed by manual source review.

Is your site exposed to CVE-2026-89870?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Other References

https://git.kernel.org/stable/c/0735e0b5a96761a9ce277a238e834008ad92a0a5 https://git.kernel.org/stable/c/3ad6cf27505017a6794f5f96c31218c2291e951b https://git.kernel.org/stable/c/4d99d8d0d895489064783601a516bd45812fa992 https://git.kernel.org/stable/c/672dbccf4351370dad002d3c78dbb29ca1588f22 https://git.kernel.org/stable/c/c4acac8cdc005b2d14b6cef5e215d264212857f3 https://git.kernel.org/stable/c/f1c4f3885df1f09bcab5296d86834d104f865e86

Frequently Asked Questions

What is CVE-2026-89870? +

In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered video_device twice zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that release callback, which kfree()s the video_device. zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device teardown could free the same video_device twice. Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the video_device was not registered there. This issue was found by a static analysis checker and confirmed by manual source review. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-89870? +

CVE-2026-89870 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

How do I check if I'm vulnerable to CVE-2026-89870? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-89870

Description

CVSS v3.1 Score

References

Other References

Frequently Asked Questions

Don't wait for an exploit