CVE-2026-72484 - Vulnerability Details

- staging: most: video: avoid double free on video register failure

Description

In the Linux kernel, the following vulnerability has been resolved:

staging: most: video: avoid double free on video register failure

comp_register_videodev() allocates a video_device with
video_device_alloc() and releases it if video_register_device() fails.

This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:

video_register_device()
-> __video_register_device()
-> device_register() fails
-> put_device(&vdev->dev)
-> v4l2_device_release()
-> vdev->release(vdev)
-> video_device_release(vdev)

comp_register_videodev()
-> video_device_release(mdev->vdev)

Use video_device_release_empty() while registering the device so that
registration failure paths do not free mdev->vdev through vdev->release().
comp_register_videodev() then releases mdev->vdev exactly once on failure.
Restore video_device_release() after successful registration so the
registered device keeps its normal lifetime handling.

This issue was found by a static analysis tool I am developing.

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel staging video driver contains a double‑free flaw that occurs when a video device registration fails. If device_register() fails, the code releases the same video_device structure twice, which can corrupt kernel memory and potentially lead to a crash or instability.

Affected Systems

This issue affects any Linux kernel that includes the staging:most video driver module. All builds containing this module remain vulnerable until the fix is applied.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector would be local, requiring interaction with the vulnerable video driver to trigger a registration failure. No remote exploitation path is described, and practical exploitation would likely need to circumvent kernel protections and achieve local control.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`eab231c0398a91fbd294672bfe9e0ff45b368246`	affected	< 009d58b73500d0b49f6ae3833f8afcb0ebd9ddbb
`eab231c0398a91fbd294672bfe9e0ff45b368246`	affected	< 430ad4ea06a0767fb44a08e2212ceb3a996607ee
`eab231c0398a91fbd294672bfe9e0ff45b368246`	affected	< 46ea51f5b2ee1a3b40c05b7c750cbc5cabe94062
`eab231c0398a91fbd294672bfe9e0ff45b368246`	affected	< 4928096212b78262dbbeab3b3abf2352278ce22d
`eab231c0398a91fbd294672bfe9e0ff45b368246`	affected	< 80ed79787da3311f76b4d71d0ce7ab992a9e134d
`eab231c0398a91fbd294672bfe9e0ff45b368246`	affected	< 43078449ad6236d839e4d707954d2e36b10a6706
`eab231c0398a91fbd294672bfe9e0ff45b368246`	affected	< 7fc162453cfb7b8e93edb16287a84ba0130cac38
`eab231c0398a91fbd294672bfe9e0ff45b368246`	affected	< 7cb1c5b32a2bfde961fff8d5204526b609bcb30a

Linux

affected

Version	Status	Constraints
`4.9`	affected	—
`0`	unaffected	< 4.9
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[eab231c0398a91fbd294672bfe9e0ff45b368246,009d58b73500d0b49f6ae3833f8afcb0ebd9ddbb)`	affected	code_commit	—
`[eab231c0398a91fbd294672bfe9e0ff45b368246,43078449ad6236d839e4d707954d2e36b10a6706)`	affected	code_commit	—
`[eab231c0398a91fbd294672bfe9e0ff45b368246,430ad4ea06a0767fb44a08e2212ceb3a996607ee)`	affected	code_commit	—
`[eab231c0398a91fbd294672bfe9e0ff45b368246,46ea51f5b2ee1a3b40c05b7c750cbc5cabe94062)`	affected	code_commit	—
`[eab231c0398a91fbd294672bfe9e0ff45b368246,4928096212b78262dbbeab3b3abf2352278ce22d)`	affected	code_commit	—
`[eab231c0398a91fbd294672bfe9e0ff45b368246,7cb1c5b32a2bfde961fff8d5204526b609bcb30a)`	affected	code_commit	—
`[eab231c0398a91fbd294672bfe9e0ff45b368246,7fc162453cfb7b8e93edb16287a84ba0130cac38)`	affected	code_commit	—
`[eab231c0398a91fbd294672bfe9e0ff45b368246,80ed79787da3311f76b4d71d0ce7ab992a9e134d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.9`	affected	generic	—
`[0,4.9)`	unaffected	semver	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update to a Linux kernel release that includes the fix for the double‑free bug in the video staging driver.
If an upgrade is not immediately possible, apply the patch from the referenced kernel commits to the source tree and rebuild the affected modules.
As a temporary precaution, disable or blacklist the staging video driver module in the kernel configuration to prevent the double‑free path from being triggered.

Generated by OpenCVE AI on August 22, 2026 at 03:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00211.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/009d58b73500d0b49f6ae3833f8afcb0ebd9ddbb
https://git.kernel.org/stable/c/43078449ad6236d839e4d707954d2e36b10a6706
https://git.kernel.org/stable/c/430ad4ea06a0767fb44a08e2212ceb3a996607ee
https://git.kernel.org/stable/c/46ea51f5b2ee1a3b40c05b7c750cbc5cabe94062
https://git.kernel.org/stable/c/4928096212b78262dbbeab3b3abf2352278ce22d
https://git.kernel.org/stable/c/7cb1c5b32a2bfde961fff8d5204526b609bcb30a
https://git.kernel.org/stable/c/7fc162453cfb7b8e93edb16287a84ba0130cac38
https://git.kernel.org/stable/c/80ed79787da3311f76b4d71d0ce7ab992a9e134d
https://lore.kernel.org/linux-cve-announce/2026081537-CVE-2026-72484-7370@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72484
https://www.cve.org/CVERecord?id=CVE-2026-72484

History

Thu, 20 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1341
References		https://lore.kernel.org/linux-cve-announce/2026081537-CVE-2026-72484-7370@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72484 https://www.cve.org/CVERecord?id=CVE-2026-72484
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure comp_register_videodev() allocates a video_device with video_device_alloc() and releases it if video_register_device() fails. This can double free the video_device when __video_register_device() reaches device_register() and that call fails: video_register_device() -> __video_register_device() -> device_register() fails -> put_device(&vdev->dev) -> v4l2_device_release() -> vdev->release(vdev) -> video_device_release(vdev) comp_register_videodev() -> video_device_release(mdev->vdev) Use video_device_release_empty() while registering the device so that registration failure paths do not free mdev->vdev through vdev->release(). comp_register_videodev() then releases mdev->vdev exactly once on failure. Restore video_device_release() after successful registration so the registered device keeps its normal lifetime handling. This issue was found by a static analysis tool I am developing.
Title		staging: most: video: avoid double free on video register failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/009d58b73500d0b49f6ae3833f8afcb0ebd9ddbb https://git.kernel.org/stable/c/43078449ad6236d839e4d707954d2e36b10a6706 https://git.kernel.org/stable/c/430ad4ea06a0767fb44a08e2212ceb3a996607ee https://git.kernel.org/stable/c/46ea51f5b2ee1a3b40c05b7c750cbc5cabe94062 https://git.kernel.org/stable/c/4928096212b78262dbbeab3b3abf2352278ce22d https://git.kernel.org/stable/c/7cb1c5b32a2bfde961fff8d5204526b609bcb30a https://git.kernel.org/stable/c/7fc162453cfb7b8e93edb16287a84ba0130cac38 https://git.kernel.org/stable/c/80ed79787da3311f76b4d71d0ce7ab992a9e134d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:57:21.528Z

Updated: 2026-08-17T05:15:34.687Z

Reserved: 2026-08-09T03:40:39.935Z

Link: CVE-2026-72484

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:22.647

Modified: 2026-08-17T06:19:16.603

Link: CVE-2026-72484

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72484 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T04:00:12Z

Weaknesses

CWE-1341
Multiple Releases of Same Resource or Handle

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object