CVE-2026-89877: media: saa7164: fix cleanup on resource allocation failure
In the Linux kernel, the following vulnerability has been resolved:
media: saa7164: fix cleanup on resource allocation failure
saa7164devsetup() adds the device to the global saa7164devlist before requesting the PCI BAR memory regions.
If getresources() fails, saa7164devsetup() decrements the device count and returns an error, but leaves the device on saa7164devlist. The probe error path then frees the device, leaving a dangling entry on the global list.
Reuse the existing MMIO mapping error path to remove the device from saa7164devlist and decrement the device count before returning.
Also release BAR0 if it was successfully requested but the BAR2 request fails.
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The failure path is reached when saa7164_dev_setup() has already added a device to the global saa7164_devlist and a subsequent PCI BAR memory-region request fails. This includes failure to request BAR memory regions during device setup, including the case where BAR0 succeeds but BAR2 fails.
What is the impact if the resource request fails?
The probe error path can free the device while a dangling entry remains on the global saa7164_devlist. If BAR0 was acquired before BAR2 fails, BAR0 may also remain unreleased without the fix.
How can I determine whether a system is exposed?
Exposure depends on use of the Linux kernel saa7164 media driver and a device setup path that encounters PCI BAR resource-allocation failure. The provided information does not identify affected kernel versions or provide a runtime detection method.
What should be done if updating is not immediately possible?
Avoid configurations or conditions that cause PCI BAR memory-region requests for an saa7164 device to fail, where feasible. The supplied fix removes the device from the global list, adjusts the device count, and releases BAR0 when a later BAR2 request fails.