CVE-2026-89887 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
media: i2c: ov7740: fix use-after-destroy in remove
The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, but then called ov7740_free_controls() which invokes both of them a second time, resulting in a double-free.
This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740_free_controls() to safely tear down the mutex and control handler in the correct order.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified within the Linux kernel media subsystem specifically affects the OV7740 camera sensor driver implemented via the I2C interface. This issue manifests as a critical use-after-destroy condition coupled with a double-free error during the device removal process. The root cause lies in an incorrect teardown sequence and redundant cleanup operations within the ov7740_remove function. In complex kernel drivers, particularly those managing hardware resources like camera sensors, the order of resource deallocation is paramount to maintaining system stability. When a driver is unloaded or a device is disconnected, it must release its dependencies before releasing the objects that depend on them. The original implementation violated this principle by destroying the synchronization mutex prior to freeing the V4L2 control handler. Since the control handler relies on the mutex for thread-safe operations during its own cleanup phase, accessing a destroyed mutex results in undefined behavior and typically triggers an immediate kernel panic due to invalid memory access or lock state corruption.
Beyond the use-after-destroy flaw, the driver code exhibited a logical error resulting in double-free vulnerabilities. The function explicitly invoked v4l2_ctrl_handler_free followed by mutex_destroy, which correctly releases those specific resources once. However, subsequent execution of ov7740_free_controls triggered these same deallocation functions again. In kernel memory management, freeing an already freed structure or object leads to heap corruption because the memory allocator's metadata becomes inconsistent. This double-free scenario can be exploited by local attackers with sufficient privileges to trigger driver unloading sequences, potentially leading to privilege escalation if the corrupted heap structures are carefully manipulated, although in this specific context, it primarily causes system instability and denial of service through kernel crashes.
From a classification perspective, this vulnerability aligns closely with CWE-416 Use After Free, as the code attempts to access or operate on resources that have already been deallocated. Additionally, the double-free aspect corresponds to CWE-415 Double Free, which is a common source of memory corruption bugs in C-based systems like the Linux kernel. In terms of attack vectors and techniques, this type of flaw can be leveraged within the ATT&CK framework under T1068 Exploitation for Privilege Escalation if an attacker can trigger the removal process from a lower-privileged context or cause it to occur during sensitive operations. It also falls under Denial of Service (T1499) due to its potential to crash the entire operating system kernel, disrupting all services running on the affected host.
The operational impact of this vulnerability is severe for systems relying on OV7740 sensors, such as embedded devices, IoT cameras, and automotive infotainment systems. A successful exploitation leads to a kernel panic, resulting in an immediate reboot or complete unavailability of the system. This disrupts continuous monitoring capabilities and can cause data loss if active processes are abruptly terminated without proper state preservation. For enterprise environments, this represents a significant reliability risk, especially in scenarios where devices must remain operational for extended periods without manual intervention. The lack of robust error handling during driver teardown means that routine maintenance or hot-unplug events could inadvertently trigger these fatal errors.
To mitigate this vulnerability, the primary remediation involves applying the provided kernel patch which restructures the cleanup logic within the ov7740_remove function. The fix ensures that the V4L2 subdevice is unregistered first, ensuring no new operations can initiate on the device while teardown proceeds. Crucially, it relies exclusively on ov7740_free_controls to handle the destruction of both the mutex and the control handler in a single, coherent sequence. This eliminates the redundant calls and enforces the correct dependency order where dependent resources are freed before their dependencies. System administrators should update their kernel packages to include this fix immediately upon availability. For developers maintaining custom kernels or out-of-tree drivers, it is essential to audit teardown sequences for similar patterns of premature resource destruction or duplicate cleanup calls to prevent analogous issues in other media driver implementations.