CVE-2026-89870

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: zoran: Avoid freeing a registered video_device twice

zoran_init_video_device() installs zoran_vdev_release() as the

video_device release callback through zoran_template. After

video_register_device() succeeds, video_unregister_device() drops the

registered video_device reference and the V4L2 core eventually invokes

that release callback, which kfree()s the video_device.

zoran_exit_video_devices() called video_unregister_device() and then

kfree(zr->video_dev), so device teardown could free the same

video_device twice.

Remove the direct kfree() and clear the cached pointer after

unregistering. The pre-registration failure path keeps its manual free

because the video_device was not registered there.

This issue was found by a static analysis checker and confirmed by

manual source review.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References