Executive brief
The OV7740 camera sensor driver in the Linux kernel had a critical bug in its cleanup routine that destroyed a mutex before code depending on it was freed, causing a kernel crash. Additionally, the cleanup code was releasing resources twice, leading to memory corruption. This vulnerability could crash systems using OV7740 camera sensors when the driver is unloaded, affecting devices like embedded cameras and IoT equipment.
Technical details
The vulnerability is a use-after-destroy and double-free bug in the ov7740_remove() function. The driver was incorrectly destroying the mutex and freeing the V4L2 control handler before unregistering the subdevice, then calling ov7740_free_controls() which attempts to destroy them again. The control handler relies on the mutex for synchronization, so destroying the mutex before freeing the handler causes a use-after-destroy panic. The fix reorders the teardown sequence to first unregister the subdevice, then call ov7740_free_controls() exclusively to properly handle both mutex and handler cleanup. The attack vector is local (driver unload/device removal) with no authentication required. A patch is available in the upstream Linux kernel.
Affected products
- Linux Linux kernel versions containing drivers/media/i2c/ov7740.c prior to commit 5d1b3dea5a44124bab6c14a2d71b977dabed54e7
Timeline
- 2026-09-16: disclosed: CVE-2026-89887 published
- 2026-07-08: patched: Fix committed upstream by Biren Pandya
- 2026-09-11: other: Patch merged into stable kernel tree