CVE-2026-89870 - Vulnerability Details

- media: zoran: Avoid freeing a registered video_device twice

Description

In the Linux kernel, the following vulnerability has been resolved:

media: zoran: Avoid freeing a registered video_device twice

zoran_init_video_device() installs zoran_vdev_release() as the
video_device release callback through zoran_template. After
video_register_device() succeeds, video_unregister_device() drops the
registered video_device reference and the V4L2 core eventually invokes
that release callback, which kfree()s the video_device.

zoran_exit_video_devices() called video_unregister_device() and then
kfree(zr->video_dev), so device teardown could free the same
video_device twice.

Remove the direct kfree() and clear the cached pointer after
unregistering. The pre-registration failure path keeps its manual free
because the video_device was not registered there.

This issue was found by a static analysis checker and confirmed by
manual source review.

Published: 2026-09-16

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel media driver for Zoran hardware contains a double‑free bug, where the video_device structure is freed twice during device teardown. This leads to kernel memory corruption that could be exploited to execute arbitrary code with kernel privileges or to destabilize the system.

Affected Systems

All Linux kernel releases that include the Zoran media driver before the patch are impacted. No specific version range is provided, so any kernel that compiles the zoran.c module without the fix is potentially vulnerable.

Risk and Exploitability

The CVSS v3.1 score of 7.8 indicates a high‑severity flaw. The EPSS score of less than 1% suggests that the likelihood of a public exploit is low at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require a local attacker who can load or interact with the Zoran device driver, making the attack vector local rather than remote.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`82e3a496eb56da0b9f29fdc5b63cedb3289e91de`	affected	< 3ad6cf27505017a6794f5f96c31218c2291e951b
`82e3a496eb56da0b9f29fdc5b63cedb3289e91de`	affected	< c4acac8cdc005b2d14b6cef5e215d264212857f3
`82e3a496eb56da0b9f29fdc5b63cedb3289e91de`	affected	< 4d99d8d0d895489064783601a516bd45812fa992
`82e3a496eb56da0b9f29fdc5b63cedb3289e91de`	affected	< f1c4f3885df1f09bcab5296d86834d104f865e86
`82e3a496eb56da0b9f29fdc5b63cedb3289e91de`	affected	< 672dbccf4351370dad002d3c78dbb29ca1588f22
`82e3a496eb56da0b9f29fdc5b63cedb3289e91de`	affected	< 0735e0b5a96761a9ce277a238e834008ad92a0a5
`bd01629315ffd5b63da91d0bd529a77d30e55028`	affected	—
`ff3357bffd9fb78f59762d8955afc7382a279079`	affected	—
`c1ba65100a359fe28cfe37e09e10c99f247cbf1e`	affected	—
`1e501ec38796f43e995731d1bcd4173cb1ccfce0`	affected	—
`5.10.110`	affected	< 5.11
`5.15.33`	affected	< 5.16
`5.16.19`	affected	< 5.17
`5.17.2`	affected	< 5.18

Linux

affected

Version	Status	Constraints
`5.18`	affected	—
`0`	unaffected	< 5.18
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[82e3a496eb56da0b9f29fdc5b63cedb3289e91de,3ad6cf27505017a6794f5f96c31218c2291e951b)`	affected	code_commit	—
`[82e3a496eb56da0b9f29fdc5b63cedb3289e91de,4d99d8d0d895489064783601a516bd45812fa992)`	affected	code_commit	—
`[82e3a496eb56da0b9f29fdc5b63cedb3289e91de,f1c4f3885df1f09bcab5296d86834d104f865e86)`	affected	code_commit	—
`[82e3a496eb56da0b9f29fdc5b63cedb3289e91de,672dbccf4351370dad002d3c78dbb29ca1588f22)`	affected	code_commit	—
`[82e3a496eb56da0b9f29fdc5b63cedb3289e91de,0735e0b5a96761a9ce277a238e834008ad92a0a5)`	affected	code_commit	—
`bd01629315ffd5b63da91d0bd529a77d30e55028`	affected	code_commit	—
`ff3357bffd9fb78f59762d8955afc7382a279079`	affected	code_commit	—
`c1ba65100a359fe28cfe37e09e10c99f247cbf1e`	affected	code_commit	—
`1e501ec38796f43e995731d1bcd4173cb1ccfce0`	affected	code_commit	—
`[5.10.110,5.11)`	affected	semver	—
`[5.15.33,5.16)`	affected	semver	—
`[5.16.19,5.17)`	affected	semver	—
`[5.17.2,5.18)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.18`	affected	semver	—
`[0,5.18)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.5,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that includes the commit removing the double free from zoran.c.
As a temporary measure, disable or unload the zoran video driver module (e.g., add modprobe.blacklist=zoran to /etc/modprobe.d or run rmmod zoran).
Verify that no other modules use the unpatched zoran driver and ensure devices depending on it are either removed or upgraded to a protected driver.

Generated by OpenCVE AI on September 18, 2026 at 03:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0735e0b5a96761a9ce277a238e834008ad92a0a5
https://git.kernel.org/stable/c/3ad6cf27505017a6794f5f96c31218c2291e951b
https://git.kernel.org/stable/c/4d99d8d0d895489064783601a516bd45812fa992
https://git.kernel.org/stable/c/672dbccf4351370dad002d3c78dbb29ca1588f22
https://git.kernel.org/stable/c/c4acac8cdc005b2d14b6cef5e215d264212857f3
https://git.kernel.org/stable/c/f1c4f3885df1f09bcab5296d86834d104f865e86

History

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 16 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered video_device twice zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that release callback, which kfree()s the video_device. zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device teardown could free the same video_device twice. Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the video_device was not registered there. This issue was found by a static analysis checker and confirmed by manual source review.
Title		media: zoran: Avoid freeing a registered video_device twice
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0735e0b5a96761a9ce277a238e834008ad92a0a5 https://git.kernel.org/stable/c/3ad6cf27505017a6794f5f96c31218c2291e951b https://git.kernel.org/stable/c/4d99d8d0d895489064783601a516bd45812fa992 https://git.kernel.org/stable/c/672dbccf4351370dad002d3c78dbb29ca1588f22 https://git.kernel.org/stable/c/c4acac8cdc005b2d14b6cef5e215d264212857f3 https://git.kernel.org/stable/c/f1c4f3885df1f09bcab5296d86834d104f865e86

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T10:31:39.271Z

Updated: 2026-09-16T14:39:26.773Z

Reserved: 2026-09-11T19:38:34.771Z

Link: CVE-2026-89870

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T11:16:55.153

Modified: 2026-09-16T15:18:14.187

Link: CVE-2026-89870

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-18T09:00:08Z

Weaknesses

No weakness.

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object