CVE-2026-89877media: saa7164: fix cleanup on resource allocation failure
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. If get_resources() fails, saa7164_dev_setup() decrements the device count and returns an error, but leaves the device on saa7164_devlist. The probe error path then frees the device, leaving a dangling entry on the global list. Reuse the existing MMIO mapping error path to remove the device from saa7164_devlist and decrement the device count before returning. Also release BAR0 if it was successfully requested but the BAR2 request fails.
- CVSS
- 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 443c1228d50518f3c550e1fef490a2c9d9246ce7 before daa5b32cdf7db81a07ee2a91ce092a363e7754aa; 443c1228d50518f3c550e1fef490a2c9d9246ce7 builds before 77f216f8de6221efb6f6c471bc9e598f1879825b; from 443c1228d50518f3c550e1fef490a2c9d9246ce7 before 69259c627009bf7621010ae9e997dad2dad3339c; 443c1228d50518f3c550e1fef490a2c9d9246ce7 builds before 4d2048466af9e2c960c5be6dcd317e3b657d268b; from 443c1228d50518f3c550e1fef490a2c9d9246ce7 before fc65623524b5bf23baddc6ae688d954fba0d5de2; 443c1228d50518f3c550e1fef490a2c9d9246ce7 builds before 28e84c6e2e6753ed238ea097b2842a32a6a6879b | CNA record |
References
- https://git.kernel.org/stable/c/daa5b32cdf7db81a07ee2a91ce092a363e7754aa
- https://git.kernel.org/stable/c/77f216f8de6221efb6f6c471bc9e598f1879825b
- https://git.kernel.org/stable/c/69259c627009bf7621010ae9e997dad2dad3339c
- https://git.kernel.org/stable/c/4d2048466af9e2c960c5be6dcd317e3b657d268b
- https://git.kernel.org/stable/c/fc65623524b5bf23baddc6ae688d954fba0d5de2
- https://git.kernel.org/stable/c/28e84c6e2e6753ed238ea097b2842a32a6a6879b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.