HIGH Introduced in 4.16
ov7740 Teardown UAF
CVE-2026-89887
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, but then called ov7740_free_controls() which invokes both of them a second time, resulting in a double-free. This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740_free_controls() to safely tear down the mutex and control handler in the correct order.
02KernelScan AI Analysis
Risk summary
A teardown order bug in the OV7740 image sensor driver destroys a mutex before the V4L2 control handler that depends on it, then double-frees both, causing a kernel panic or memory corruption. Any local user with access to the I2C device can trigger it by unbinding the driver, leading to denial of service or potential privilege escalation.
Vulnerability analysis
The OV7740 image sensor driver's remove function destroys a mutex before freeing the V4L2 control handler that relies on it, then calls a cleanup helper that frees both a second time, producing a use-after-destroy and double-free. The fix unregisters the subdevice first and delegates all teardown to the existing cleanup helper, which frees the control handler and destroys the mutex in the correct order. The bug is reachable locally by any user who can trigger device removal (e.g., via sysfs unbind) on a system with the OV7740 sensor driver loaded; no special privileges beyond access to the I2C device node are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.16 | 5.10.270 | 9e4693436c7d |
| 5.15 | 4.16 | 5.15.221 | 81e9765878d3 |
| 6.1 | 4.16 | 6.1.188 | 8a02ee6c1c4e |
| 6.12 | 4.16 | 6.12.110 | 25e2505866c5 |
| 6.18 | 4.16 | 6.18.51 | af81f35e4f42 |
| 6.6 | 4.16 | 6.6.157 | 7512838a19af |
| 7.2 | 4.16 | 7.2.5 | 09453b467990 |
| mainline | 4.16 | 7.3 | 5d1b3dea5a44 |
| cip/5.10 | 4.16 | 5.10.271-cip78 | 9e4693436c7d |
| cip/6.1 | 4.16 | 6.1.189-cip61 | 8a02ee6c1c4e |
| cip/6.1-rt | 4.16 | 6.1.189-cip61-rt32 | 8a02ee6c1c4e |
| cip/6.12 | 4.16 | 6.12.111-cip32 | 25e2505866c5 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |