CVE-2026-89870 Overview
CVE-2026-89870 is a double-free vulnerability in the Linux kernel's Zoran media driver. The flaw resides in zoran_exit_video_devices(), which frees a video_device structure that the V4L2 core already releases through the registered zoran_vdev_release() callback. Local users with access to the affected device can trigger memory corruption during device teardown, leading to potential privilege escalation or denial of service. The issue was discovered through static analysis and confirmed by manual source review. Kernel maintainers resolved the flaw by removing the redundant kfree() and clearing the cached pointer after unregistration.
Critical Impact
Local attackers can trigger memory corruption in the Linux kernel during Zoran video device teardown, enabling potential privilege escalation with full confidentiality, integrity, and availability impact.
Affected Products
- Linux kernel versions containing the Zoran media driver (drivers/media/pci/zoran)
- Distributions shipping vulnerable kernel builds prior to the referenced stable patches
- Systems with the zoran module loaded and accessible V4L2 device nodes
Discovery Timeline
- 2026-09-16 - CVE-2026-89870 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89870
Vulnerability Analysis
The vulnerability is a double-free [CWE-415] in the Zoran V4L2 driver's device teardown path. During initialization, zoran_init_video_device() installs zoran_vdev_release() as the release callback for the video_device structure via zoran_template. After video_register_device() succeeds, the V4L2 core owns the reference and invokes the release callback when the device is unregistered.
The teardown routine zoran_exit_video_devices() calls video_unregister_device() and then directly executes kfree(zr->video_dev). Because the V4L2 core eventually calls the release callback that also frees the same allocation, the structure is released twice.
A double free on kernel slab objects can corrupt allocator metadata, enable use-after-free primitives, and allow an attacker to influence subsequent allocations for arbitrary memory writes.
Root Cause
The root cause is duplicated ownership of the video_device lifetime. Once video_register_device() succeeds, the release callback assumes exclusive responsibility for freeing the object. The driver failed to account for that transfer and issued a manual free after unregistration.
Attack Vector
Exploitation requires local access with permission to trigger driver initialization or teardown, typically through module load or hardware event. The attack does not require user interaction and executes with low privileges. Successful exploitation corrupts kernel heap state and can escalate to root-level code execution.
No public proof-of-concept is available. See the upstream fix commit for the exact code change.
Detection Methods for CVE-2026-89870
Indicators of Compromise
- Kernel oops or panic messages referencing zoran_vdev_release, video_unregister_device, or slab double-free warnings
- SLUB: double free detected or KASAN: use-after-free reports involving video_device allocations
- Unexpected crashes on hardware unbind or module unload of the zoran driver
Detection Strategies
- Enable CONFIG_SLUB_DEBUG and CONFIG_KASAN in test environments to catch double-free events during driver teardown
- Audit installed kernel versions against the fixed commits listed in the kernel.org references
- Monitor dmesg and syslog aggregation for slab allocator warnings tied to V4L2 subsystem symbols
Monitoring Recommendations
- Forward kernel logs to a centralized SIEM and alert on double-free and KASAN signatures
- Track loaded kernel modules and flag hosts that retain the zoran driver on unpatched kernels
- Correlate device hotplug and module unload events with kernel crash telemetry
How to Mitigate CVE-2026-89870
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the kernel.org commit list and reboot affected systems
- Unload the zoran module on hosts that do not require Zoran capture hardware using modprobe -r zoran
- Restrict physical and local shell access to systems that must run vulnerable kernels until patched
Patch Information
The fix removes the redundant kfree(zr->video_dev) call and clears the cached pointer after video_unregister_device(). The pre-registration failure path retains its manual free because the device was never registered. Patches are available across multiple stable branches, including commit 4d99d8d0, commit 3ad6cf27, commit 0735e0b5, commit 672dbccf, commit c4acac8c, and commit f1c4f388.
Workarounds
- Blacklist the zoran module on systems without Zoran capture cards to prevent load
- Enforce access controls on /dev/video* nodes to restrict interaction with V4L2 devices
- Deploy kernel lockdown and reduced attack surface configurations on multi-user hosts
# Blacklist the vulnerable driver until patched kernels are deployed
echo 'blacklist zoran' | sudo tee /etc/modprobe.d/blacklist-zoran.conf
sudo modprobe -r zoran 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
