CVE-2026-89870 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
media: zoran: Avoid freeing a registered video_device twice
zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that release callback, which kfree()s the video_device.
zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device teardown could free the same video_device twice.
Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the video_device was not registered there.
This issue was found by a static analysis checker and confirmed by manual source review.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in the Linux kernel media subsystem, specifically within the zoran driver, constitutes a double-free error that arises from improper resource management during device teardown operations. This flaw is rooted in the lifecycle management of video_device structures, which are critical components for Video4Linux2 (V4L2) devices to function correctly within the operating system. The core issue stems from an inconsistency between how resources are allocated and freed depending on whether the registration process succeeds or fails. When a device is successfully registered via video_register_device(), the kernel assigns zoran_vdev_release as the release callback for that specific video_device instance. This mechanism ensures that when the reference count to the device drops to zero, typically triggered by video_unregister_device(), the V4L2 core automatically invokes this callback to safely deallocate memory using kfree(). However, the exit routine zoran_exit_video_devices incorrectly attempted to manage this lifecycle manually after calling video_unregister_device. By invoking both video_unregister_device and a subsequent manual kfree on the same pointer, the driver created a scenario where the kernel's internal reference counting logic would eventually trigger the release callback again, leading to a second deallocation of memory that had already been freed by the explicit call in the exit path.
From a technical perspective, this double-free vulnerability represents a severe integrity violation within the kernel space. The immediate consequence is heap corruption, as the allocator's metadata for the previously freed block may be overwritten or accessed incorrectly during the second free operation. This can lead to system instability, including kernel panics and crashes, effectively causing a denial of service against the host machine. In more sophisticated attack scenarios, an attacker who can influence the state leading up to this teardown sequence might exploit the corrupted heap metadata to achieve arbitrary code execution. By carefully crafting memory allocations around the double-free site, it is possible to overwrite function pointers or other critical data structures in adjacent kernel objects, thereby gaining control over the processor's instruction flow and escalating privileges from a standard user context to root level access within the operating system.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-415, which defines double free as freeing memory twice without resetting the pointer or checking for null status before subsequent frees. It also relates closely to CWE-762, where mismatched allocation and deallocation mechanisms create inconsistencies in resource management. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates techniques associated with privilege escalation and defense evasion through memory corruption. The exploitation vector typically requires local access to trigger the device removal process, placing it within the scope of Local Privilege Escalation tactics where an adversary leverages software vulnerabilities to gain higher-level permissions on a compromised system.
The remediation strategy implemented in this resolution involves removing the redundant manual kfree call from zoran_exit_video_devices and ensuring that the cached pointer is cleared immediately after unregistering the device. This adjustment aligns the teardown process with the kernel's expected lifecycle for registered devices, relying entirely on the V4L2 core to handle deallocation via the assigned release callback. It is important to note that this fix preserves manual memory management only in pre-registration failure paths where video_register_device has not yet succeeded and therefore no automatic cleanup mechanism exists. This distinction ensures that resources are correctly managed regardless of whether initialization completes successfully or fails midway, thereby eliminating the race condition and double-free potential while maintaining robustness across all execution branches within the driver's lifecycle.