Executive brief
The Linux kernel's saa7164 media driver (used for SAA7164 PCI video capture devices) contains a resource cleanup bug in its device initialization code. If memory resource allocation fails partway through setup, the device remains on an internal global list but is freed, creating a dangling pointer. This can lead to kernel memory corruption, crashes, or denial of service when the kernel later attempts to access the stale device reference.
Technical details
The vulnerability is a use-after-free and resource leak in the saa7164_dev_setup() function within the Linux kernel's media subsystem. The root cause is that the function adds a device to the global saa7164_devlist before requesting PCI BAR memory regions. If get_resources() fails, the device count is decremented and an error is returned, but the device remains on the devlist. The probe error path then frees the device, leaving a dangling list entry. Additionally, if BAR0 allocation succeeds but BAR2 allocation fails, BAR0 is not properly released. The fix involves reusing the existing error path to properly remove the device from devlist and conditionally releasing BAR0 resources. This is a local kernel issue affecting systems with SAA7164 video capture hardware during device initialization failures.
Affected products
- Linux Linux kernel all versions (fix backported across linux-2.6.11.y through linux-7.2.y)
Timeline
- 2026-09-16: disclosed: CVE-2026-89877 published
- 2026-07-18: patched: Fix committed by Guangshuo Li (commit 28e84c6e2e6753ed238ea097b2842a32a6a6879b)
- 2026-09-11: other: Fix backported to stable kernel by Greg Kroah-Hartman (commit 4d2048466af9e2c960c5be6dcd317e3b657d268b)