CVE-2026-89887: media: i2c: ov7740: fix use-after-destroy in remove
In the Linux kernel, the following vulnerability has been resolved:
media: i2c: ov7740: fix use-after-destroy in remove
The ov7740remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2ctrlhandlerfree() and mutexdestroy() sequentially, but then called ov7740freecontrols() which invokes both of them a second time, resulting in a double-free.
This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740freecontrols() to safely tear down the mutex and control handler in the correct order.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux ov7740 media I2C driver are exposed when the driver is removed and its teardown path runs.
What is the likely operational symptom if the vulnerable teardown path is triggered?
The use-after-destroy condition can cause a kernel panic. The teardown path also performs duplicate cleanup that can result in a double-free.
What does the fix change?
The fix unregisters the V4L2 subdevice before cleanup and relies only on ov7740_free_controls() to release the mutex and V4L2 control handler in the correct order.