CVE-2026-89741 Overview
CVE-2026-89741 is a memory corruption flaw in the Linux kernel's Video4Linux2 (V4L2) subsystem. The vulnerability existed in the __video_register_device() function within media/v4l2-dev, where an earlier fix commit (2a934fdb01db) introduced a double-free condition. When device_register() failed, the patched code called put_device(), which released the video_device structure. V4L2 drivers subsequently followed the documented API contract and called video_device_release(), which invoked kfree() on the already-freed structure. Kernel maintainers reverted the offending commit, accepting a small memory leak as a safer outcome than a double-free.
Critical Impact
A local authenticated user triggering a failed V4L2 device registration can cause a double-free in kernel memory, leading to memory corruption, denial of service, or potential local privilege escalation.
Affected Products
- Linux kernel versions containing commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a
- Linux stable branches prior to the revert commits referenced in kernel.org advisories
- Distributions shipping affected mainline and stable kernel releases with V4L2 media support
Discovery Timeline
- 2026-09-11 - CVE-2026-89741 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89741
Vulnerability Analysis
The flaw resides in the V4L2 device registration path in drivers/media/v4l2-core/v4l2-dev.c. The reverted commit attempted to correct error handling by invoking put_device() when device_register() failed, following standard Linux device model semantics. This action decrements the reference counter, and when it reaches zero the release callback frees the underlying video_device structure.
However, the V4L2 API contract requires callers of video_register_device() to invoke video_device_release() on failure. That function calls kfree() on the same video_device allocation. The two release paths overlap, freeing the same object twice.
Double-free conditions in the kernel slab allocator corrupt freelist metadata. An attacker able to trigger allocation reuse between the two frees can influence subsequent object contents, creating a primitive for local privilege escalation or kernel panic.
Root Cause
The root cause is an inconsistency between the Linux device model's reference-counted cleanup pattern and the V4L2 subsystem's manual kfree()-based release contract. A comprehensive fix would require splitting video_register_device() into initialization and registration phases and refactoring every V4L2 driver. Because device_register() failure is rare, maintainers chose to revert to the leak-on-failure behavior.
Attack Vector
Exploitation requires local access with permissions to load a V4L2 driver or trigger device registration through a vulnerable media driver. The attacker must drive the code path in which device_register() fails, for example by exhausting a resource, injecting a fault, or exploiting a driver that unregisters during initialization. Successful triggering yields a double-free of the video_device structure, corrupting kernel slab state.
No verified public exploit is available. See the kernel.org revert commits for technical details of the affected code path.
Detection Methods for CVE-2026-89741
Indicators of Compromise
- Kernel log entries containing kernel BUG at mm/slub.c, double free detected in tcache, or SLUB freelist corruption messages referencing video_device
- Unexpected kernel panics or oops reports originating in v4l2-dev.c or __video_register_device
- KASAN reports flagging use-after-free or double-free in the media subsystem
Detection Strategies
- Enable CONFIG_SLUB_DEBUG and CONFIG_KASAN on test systems to catch double-free events in the V4L2 path
- Correlate kernel crash telemetry with recent V4L2 driver load or unload activity
- Monitor for unprivileged users repeatedly loading media modules or accessing /dev/video* device nodes
Monitoring Recommendations
- Forward /var/log/kern.log, dmesg, and journalctl -k output to a centralized log platform for kernel crash analysis
- Alert on kmsg entries containing slab, double-free, KASAN, or stack traces referencing v4l2_device_register or video_register_device
- Track kernel version inventory across the fleet to identify hosts still running unpatched builds
How to Mitigate CVE-2026-89741
Immediate Actions Required
- Apply the kernel updates that include the revert commits published on kernel.org for all affected stable branches
- Inventory systems running V4L2-enabled kernels, including servers with virtual media devices, workstations, and embedded Linux appliances
- Restrict local access on multi-user hosts until patched kernels are deployed and systems are rebooted
Patch Information
Linux kernel maintainers released the fix as a revert of commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a across multiple stable branches. Relevant fix commits include 2ac009a, 3de14b4, 712ca1c, 8027f82, 8b998c1, aad08b5, ce792b9, and e7600f5. Rebuild custom kernels from stable trees that include these commits and reboot to activate the fix.
Workarounds
- Blacklist unnecessary V4L2 media drivers on systems that do not require video capture functionality using /etc/modprobe.d/ deny entries
- Restrict access to /dev/video* device nodes with tightened file permissions and udev rules
- Limit the ability of unprivileged users to load kernel modules by setting kernel.modules_disabled=1 after boot where operationally feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.