UBUNTU-CVE-2026-89870: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered videodevice twice zoraninitvideodevice() installs zoranvdevrelease() as the videodevice release callback through zorantemplate. After videoregisterdevice() succeeds, videounregisterdevice() drops the registered videodevice reference and the V4L2 core eventually invokes that release callback, which kfree()s the videodevice. zoranexitvideodevices() called videounregisterdevice() and then kfree(zr->videodev), so device teardown could free the same videodevice twice. Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the videodevice was not registered there. This issue was found by a static analysis checker and confirmed by manual source review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
After calling video_unregister_device(), clear the cached video_device pointer and do not directly kfree() it; retain the manual free only on the pre-registration failure path where the video_device was not registered.
Linux kernel media zoran driver zoran_exit_video_devices() teardown = Remove direct kfree(zr->video_dev) and clear the cached pointer after video_unregister_device()
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running one of the listed Ubuntu Linux kernel packages may be affected if they use the Zoran media driver and the affected video-device teardown path is reached. The issue concerns registered V4L2 video devices managed by that driver.
What conditions are needed to trigger the double free?
A Zoran video_device must first be successfully registered with the V4L2 core, then be unregistered during device teardown. The vulnerable teardown code unregisters the device, whose release callback frees it, and then directly frees the same cached pointer again.
Is the pre-registration error path affected?
No. The described manual free remains valid when registration fails because the video_device was never registered and therefore the V4L2 release callback does not own its cleanup.
How can I determine whether a system is affected in practice?
Confirm whether the running kernel includes the vulnerable Zoran driver code and whether Zoran-backed media hardware is present and in use. The supplied data does not identify affected or fixed package versions.