CVE-2026-89887
Description
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, but then called ov7740_free_controls() which invokes both of them a second time, resulting in a double-free. This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740_free_controls() to safely tear down the mutex and control handler in the correct order.
How to fix
- Linux Linux9e4693436c7dcf8584002500ce4b434b79bbf9ed, 81e9765878d3ac8ad18e3a683332b5d6bc3a0e33, 8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e, 7512838a19af0a284a58435292243fad21e57ff1, 25e2505866c577db2661e4d431f0907c6ec9a3b4, af81f35e4f429e769b784754e1aa4d7a922470ac, 09453b467990e8ef8fe09f45a685f9a625248d33, 5d1b3dea5a44124bab6c14a2d71b977dabed54e7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 39c5c4471b8d793daf868bd004e56ed420e89707 ≤ v < 9e4693436c7dcf8584002500ce4b434b79bbf9ed, 39c5c4471b8d793daf868bd004e56ed420e89707 ≤ v < 81e9765878d3ac8ad18e3a683332b5d6bc3a0e33, 39c5c4471b8d793daf868bd004e56ed420e89707 ≤ v < 8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e, 39c5c4471b8d793daf868bd004e56ed420e89707 ≤ v < 7512838a19af0a284a58435292243fad21e57ff1, 39c5c4471b8d793daf868bd004e56ed420e89707 ≤ v < 25e2505866c577db2661e4d431f0907c6ec9a3b4, 39c5c4471b8d793daf868bd004e56ed420e89707 ≤ v < af81f35e4f429e769b784754e1aa4d7a922470ac, 39c5c4471b8d793daf868bd004e56ed420e89707 ≤ v < 09453b467990e8ef8fe09f45a685f9a625248d33, 39c5c4471b8d793daf868bd004e56ed420e89707 ≤ v < 5d1b3dea5a44124bab6c14a2d71b977dabed54e7, 4.16 | 9e4693436c7dcf8584002500ce4b434b79bbf9ed, 81e9765878d3ac8ad18e3a683332b5d6bc3a0e33, 8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e, 7512838a19af0a284a58435292243fad21e57ff1, 25e2505866c577db2661e4d431f0907c6ec9a3b4, af81f35e4f429e769b784754e1aa4d7a922470ac, 09453b467990e8ef8fe09f45a685f9a625248d33, 5d1b3dea5a44124bab6c14a2d71b977dabed54e7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.