HIGH Introduced in 2.6.32
saa7164 DevList UAF
CVE-2026-89877
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. If get_resources() fails, saa7164_dev_setup() decrements the device count and returns an error, but leaves the device on saa7164_devlist. The probe error path then frees the device, leaving a dangling entry on the global list. Reuse the existing MMIO mapping error path to remove the device from saa7164_devlist and decrement the device count before returning. Also release BAR0 if it was successfully requested but the BAR2 request fails.
02KernelScan AI Analysis
Risk summary
A use-after-free in the SAA7164 PCI media driver occurs when BAR resource allocation fails during device probe, leaving a freed device structure on a global list that a kernel thread later traverses. Systems with SAA7164-based TV tuner hardware (e.g., Hauppauge HVR-2200/2250) are at risk. The vulnerability can lead to kernel memory corruption, information disclosure, or denial of service.
Vulnerability analysis
When a SAA7164 PCI media device is probed and the driver fails to reserve its hardware memory regions, the error path frees the device structure but leaves a stale pointer on an internal driver list. A background kernel thread that periodically walks that list later touches the freed memory, causing a use-after-free. The corrected cleanup now deletes the device from the list before returning the error, and also releases any memory region that was already claimed if a later reservation fails. A system must have this specific PCI hardware installed and experience a resource conflict during device initialization for the flaw to manifest; no attacker interaction is required once the dangling entry exists.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 2.6.32 | 7.3-rc1 | 28e84c6e2e67 |
| 6.18 | 2.6.32 | 6.18.51 | 4d2048466af9 |
| 6.12 | 2.6.32 | 6.12.110 | 69259c627009 |
| 6.6 | 2.6.32 | 6.6.157 | 77f216f8de62 |
| 7.2 | 2.6.32 | 7.2.5 | fc65623524b5 |
| 6.1 | 2.6.32 | 6.1.188 | daa5b32cdf7d |
| cip/6.12 | 2.6.32 | 6.12.111-cip32 | 69259c627009 |