UBUNTU-CVE-2026-89877: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164devsetup() adds the device to the global saa7164devlist before requesting the PCI BAR memory regions. If getresources() fails, saa7164devsetup() decrements the device count and returns an error, but leaves the device on saa7164devlist. The probe error path then frees the device, leaving a dangling entry on the global list. Reuse the existing MMIO mapping error path to remove the device from saa7164devlist and decrement the device count before returning. Also release BAR0 if it was successfully requested but the BAR2 request fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In saa7164_dev_setup(), release BAR0 if it was successfully requested but the BAR2 request fails.
- Compensating control
Reuse the existing MMIO mapping error path to remove the device from saa7164_devlist and decrement the device count before returning from saa7164_dev_setup() after get_resources() fails.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected software list includes Ubuntu kernel packages for standard, AWS, Azure, GCP, and FIPS variants. Exposure requires hardware using the saa7164 media driver to be probed.
What conditions are required to trigger the vulnerable path?
The issue occurs when saa7164 device setup adds a device to the global list and PCI BAR resource acquisition subsequently fails. A failure requesting BAR memory regions, including failure after BAR0 succeeds but BAR2 fails, can leave a dangling device-list entry.
What is the impact of a failed probe on an affected system?
The probe error path can free the device while its entry remains on the global saa7164 device list. This creates a dangling list entry; the stated severity vector rates confidentiality, integrity, and availability impact as high.