CVE-2026-89887

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-89887
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89887.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-89887
Downstream
Published
2026-09-16T10:31:51Z
Modified
2026-09-18T03:48:33Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
media: i2c: ov7740: fix use-after-destroy in remove
Details

In the Linux kernel, the following vulnerability has been resolved:

media: i2c: ov7740: fix use-after-destroy in remove

The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, but then called ov7740_free_controls() which invokes both of them a second time, resulting in a double-free.

This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740_free_controls() to safely tear down the mutex and control handler in the correct order.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89887.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
39c5c4471b8d793daf868bd004e56ed420e89707
Fixed
9e4693436c7dcf8584002500ce4b434b79bbf9ed
Fixed
81e9765878d3ac8ad18e3a683332b5d6bc3a0e33
Fixed
8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e
Fixed
7512838a19af0a284a58435292243fad21e57ff1
Fixed
25e2505866c577db2661e4d431f0907c6ec9a3b4
Fixed
af81f35e4f429e769b784754e1aa4d7a922470ac
Fixed
09453b467990e8ef8fe09f45a685f9a625248d33
Fixed
5d1b3dea5a44124bab6c14a2d71b977dabed54e7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89887.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.16.0
Fixed
5.10.270
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.221
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.188
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.157
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.110
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.51
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89887.json"