HIGH
v4l2 DeviceRegister DoubleFree
CVE-2026-89741
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-dev: fix error handling in __video_register_device()" This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a. The intentions of that patch were good, but it doesn't work. The idea is that if device_register fails, you have to do a put_device to let the ref counter release resources. However, the V4L2 API says that if video_register_device() fails, then you have to call video_device_release(), which kfree()s the video_device struct. But the put_device() will already have freed the struct, so you end up in a double-free scenario. There is not really a good way of fixing this without breaking video_register_device() into two parts, one that initializes everything, and one that does the actual device_register, and then converting all V4L2 drivers to this new model. That is a massive job, and it is very unlikely that device_register will fail. So rather than ending up in a double-free scenario, just revert this patch, and in that case we'll have a small memory leak. Which is a lot more robust.
02KernelScan AI Analysis
Risk summary
A double-free vulnerability exists in the V4L2 video device registration path. If the internal device registration step fails, the error handling frees the device structure, but the V4L2 API contract also requires the calling driver to free the same structure on failure, resulting in a double-free. Exploitation requires root privileges or physical access to trigger device registration, and the failure condition is very unlikely, but if triggered the heap corruption could lead to privilege escalation or kernel crash.
Vulnerability analysis
If registration of a video device fails, the kernel's error-handling logic frees the device object, but the driver is also expected to free that same object. This causes the same memory to be freed twice, corrupting the kernel heap. The fix removes the conflicting kernel-side cleanup so that only the driver frees the object on failure; this leaves a small memory leak instead, which is much safer. The code is reached when a video device is registered, which can happen when hardware such as a camera is connected or when a privileged user loads a video driver, though the registration failure itself is considered very unlikely.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.10.239 | 5.10.270 | 8b998c171ed8 |
| 5.15 | 5.15.186 | 5.15.221 | 3de14b4f681a |
| 5.4 | 5.4.295 | 5.5 | aad08b5f67d2 |
| 6.1 | 6.1.142 | 6.1.188 | 8027f82c0f54 |
| 6.12 | 6.12.35 | 6.12.109 | 712ca1cf756d |
| 6.15 | 6.15.4 | 6.16 | ce792b94e038 |
| 6.18 | — | 6.18.50 | e7600f5cee5d |
| 6.6 | 6.6.95 | 6.6.157 | 2ac009a65d23 |
| 7.2 | — | 7.2.4 | — |
| mainline | — | 7.3 | — |
| cip/5.10 | — | 5.10.271-cip78 | 8b998c171ed8 |
| cip/6.1 | — | 6.1.189-cip61 | 8027f82c0f54 |
| cip/6.1-rt | — | 6.1.189-cip61-rt32 | 8027f82c0f54 |
| cip/6.12 | — | 6.12.111-cip32 | 712ca1cf756d |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |