CVE-2026-89870: media: zoran: Avoid freeing a registered video_device twice
In the Linux kernel, the following vulnerability has been resolved:
media: zoran: Avoid freeing a registered videodevice twice
zoraninitvideodevice() installs zoranvdevrelease() as the videodevice release callback through zorantemplate. After videoregisterdevice() succeeds, videounregisterdevice() drops the registered videodevice reference and the V4L2 core eventually invokes that release callback, which kfree()s the videodevice.
zoranexitvideodevices() called videounregisterdevice() and then kfree(zr->videodev), so device teardown could free the same videodevice twice.
Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the videodevice was not registered there.
This issue was found by a static analysis checker and confirmed by manual source review.
Event History
Frequently Asked Questions
Are failures before video_register_device() succeeds affected?
No. The pre-registration failure path remains manually freed because the video_device was not registered and therefore is not released by the V4L2 core.
When does the double-free condition occur?
It occurs during teardown after video_register_device() has succeeded. video_unregister_device() releases the registered device reference and eventually invokes the configured release callback, so directly freeing the cached video_device pointer afterward can free it a second time.