Executive brief
The zoran video capture driver in the Linux kernel had a double-free vulnerability in its device cleanup code. When a video device was unregistered, the kernel's V4L2 core automatically freed the device through a release callback, but the driver code then attempted to free it a second time, potentially causing system crashes or memory corruption. This affects systems using zoran-based video capture hardware.
Technical details
The vulnerability is a double-free (CWE-415) in the zoran driver's video_device cleanup. The zoran_init_video_device() function registers a release callback (zoran_vdev_release) that automatically frees the video_device structure when video_register_device() succeeds and the device is later unregistered. However, zoran_exit_video_devices() called video_unregister_device() followed by an explicit kfree(zr->video_dev), causing the same memory to be freed twice. An attacker with local access to a system with zoran hardware (or loaded driver) could trigger device removal to cause a kernel crash or potentially achieve code execution through heap corruption. The fix removes the explicit kfree() and sets the cached pointer to NULL after unregistration.
Affected products
- Linux Linux kernel Affected versions prior to commit 0735e0b5a96761a9ce277a238e834008ad92a0a5; see stable branches linux-5.x through linux-7.x and others
Timeline
- 2026-09-16: disclosed: CVE-2026-89870 published
- 2026-07-28: patched: Fix committed upstream by Hans Verkuil
- 2026-09-14: patched: Backported to stable kernel series