CVE-2026-89887media: i2c: ov7740: fix use-after-destroy in remove
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, but then called ov7740_free_controls() which invokes both of them a second time, resulting in a double-free. This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740_free_controls() to safely tear down the mutex and control handler in the correct order.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 39c5c4471b8d793daf868bd004e56ed420e89707 builds before 9e4693436c7dcf8584002500ce4b434b79bbf9ed; from 39c5c4471b8d793daf868bd004e56ed420e89707 before 81e9765878d3ac8ad18e3a683332b5d6bc3a0e33; 39c5c4471b8d793daf868bd004e56ed420e89707 builds before 8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e; from 39c5c4471b8d793daf868bd004e56ed420e89707 before 7512838a19af0a284a58435292243fad21e57ff1; 39c5c4471b8d793daf868bd004e56ed420e89707 builds before 25e2505866c577db2661e4d431f0907c6ec9a3b4; from 39c5c4471b8d793daf868bd004e56ed420e89707 before af81f35e4f429e769b784754e1aa4d7a922470ac; from 39c5c4471b8d793daf868bd004e56ed420e89707 before 09453b467990e8ef8fe09f45a685f9a625248d33; 39c5c4471b8d793daf868bd004e56ed420e89707 builds before 5d1b3dea5a44124bab6c14a2d71b977dabed54e7 | CNA record |
References
- https://git.kernel.org/stable/c/9e4693436c7dcf8584002500ce4b434b79bbf9ed
- https://git.kernel.org/stable/c/81e9765878d3ac8ad18e3a683332b5d6bc3a0e33
- https://git.kernel.org/stable/c/8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e
- https://git.kernel.org/stable/c/7512838a19af0a284a58435292243fad21e57ff1
- https://git.kernel.org/stable/c/25e2505866c577db2661e4d431f0907c6ec9a3b4
- https://git.kernel.org/stable/c/af81f35e4f429e769b784754e1aa4d7a922470ac
- https://git.kernel.org/stable/c/09453b467990e8ef8fe09f45a685f9a625248d33
- https://git.kernel.org/stable/c/5d1b3dea5a44124bab6c14a2d71b977dabed54e7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.