HIGH
zoran VideoDevice UAF
CVE-2026-89870
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.6MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered video_device twice zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that release callback, which kfree()s the video_device. zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device teardown could free the same video_device twice. Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the video_device was not registered there. This issue was found by a static analysis checker and confirmed by manual source review.
02KernelScan AI Analysis
Risk summary
A double-free vulnerability exists in the Zoran ZR36057 PCI video capture driver's device teardown path. The V4L2 core's release callback frees the video device memory, and the driver's cleanup function then frees the same pointer again. Exploitation requires root-level access to trigger module unload or device removal, and the specific Zoran PCI hardware must be present.
Vulnerability analysis
When a Zoran video capture device is torn down, the driver unregisters its video device and then directly frees the underlying memory. However, the V4L2 core already owns a release callback that frees that same memory after the device reference is dropped, so the driver's direct free causes the memory to be released twice. The fix removes the driver's manual free and instead clears its cached pointer after unregistering, leaving the release callback as the sole path that frees the device. The pre-registration failure path retains its manual free because the release callback never runs for an unregistered device. This vulnerability is only reachable during device or module teardown, which requires privileged local access, and only on systems where Zoran ZR36057-based PCI video capture hardware and its driver are present.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.10.110 | 5.11 | 3ad6cf275050 |
| 5.16 | 5.16.19 | 5.17 | 4d99d8d0d895 |
| 6.1 | — | 6.1.188 | 672dbccf4351 |
| 6.6 | — | 6.6.157 | 0735e0b5a967 |
| 6.12 | — | 6.12.110 | — |
| 6.18 | — | 6.18.51 | — |
| 7.2 | — | 7.2.5 | — |
| mainline | — | 7.3-rc1 | — |
| 5.15 | 5.15.33 | 5.16 | c4acac8cdc00 |
| 5.17 | 5.17.2 | 5.18 | f1c4f3885df1 |
| cip/6.12 | — | 6.12.111-cip32 | 4d99d8d0d895 |