CVE-2026-89877: media: saa7164: fix cleanup on resource allocation failure
In the Linux kernel, the following vulnerability has been resolved:
media: saa7164: fix cleanup on resource allocation failure
saa7164devsetup() adds the device to the global saa7164devlist before requesting the PCI BAR memory regions.
If getresources() fails, saa7164devsetup() decrements the device count and returns an error, but leaves the device on saa7164devlist. The probe error path then frees the device, leaving a dangling entry on the global list.
Reuse the existing MMIO mapping error path to remove the device from saa7164devlist and decrement the device count before returning.
Also release BAR0 if it was successfully requested but the BAR2 request fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.188 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.51 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.5 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In saa7164_dev_setup(), when the BAR2 request fails after BAR0 was successfully requested, release BAR0; on get_resources() failure, remove the device from saa7164_devlist, decrement the device count, and return the error before the probe path frees the device.
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The failure path is reached when saa7164_dev_setup() has already added a device to the global saa7164_devlist and a subsequent PCI BAR memory-region request fails. This includes failure to request BAR memory regions during device setup, including the case where BAR0 succeeds but BAR2 fails.
What is the impact if the resource request fails?
The probe error path can free the device while a dangling entry remains on the global saa7164_devlist. If BAR0 was acquired before BAR2 fails, BAR0 may also remain unreleased without the fix.
How can I determine whether a system is exposed?
Exposure depends on use of the Linux kernel saa7164 media driver and a device setup path that encounters PCI BAR resource-allocation failure. The provided information does not identify affected kernel versions or provide a runtime detection method.
What should be done if updating is not immediately possible?
Avoid configurations or conditions that cause PCI BAR memory-region requests for an saa7164 device to fail, where feasible. The supplied fix removes the device from the global list, adjusts the device count, and releases BAR0 when a later BAR2 request fails.