CVE-2026-89877: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89877 Overview

CVE-2026-89877 is a resource cleanup vulnerability in the Linux kernel saa7164 media driver. The flaw lives in saa7164_dev_setup(), which registers a device on the global saa7164_devlist before requesting the PCI Base Address Register (BAR) memory regions. When get_resources() fails, the function decrements the device count and returns an error but leaves the device on the global list. The probe error path then frees the device, leaving a dangling entry that later code can dereference.

Critical Impact
A local attacker who can trigger a PCI resource allocation failure on a system with the saa7164 driver may cause kernel memory corruption via a dangling pointer on saa7164_devlist, threatening confidentiality, integrity, and availability.

Affected Products

Linux kernel with saa7164 media driver enabled
Systems using NXP SAA7164-based PCIe TV tuner cards
Distributions shipping vulnerable kernel versions prior to the fix commits

Discovery Timeline

2026-09-16 - CVE-2026-89877 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89877

Vulnerability Analysis

The vulnerability is a use-after-free style cleanup flaw in the saa7164 PCI media driver initialization path. During probe, saa7164_dev_setup() adds the new device structure to the global saa7164_devlist before it requests the PCI BAR memory regions through get_resources(). This ordering assumes that all subsequent failure paths correctly unlink the device from the list.

When get_resources() fails, the function only decrements the device count. It returns an error while leaving a pointer to the soon-to-be-freed device on saa7164_devlist. The caller in the probe path then releases the device memory. Any later traversal of saa7164_devlist operates on a dangling pointer, producing kernel memory corruption, oops conditions, or exploitable use-after-free primitives.

The patch reuses the existing MMIO mapping error path to unlink the device from saa7164_devlist and decrement the device count before returning. It also releases BAR0 when BAR0 was successfully requested but BAR2 request subsequently fails, preventing a leak of PCI memory region reservations.

Root Cause

The root cause is an ordering defect between global state registration and resource acquisition. Global list insertion precedes acquisition of PCI BAR regions, but the failure handler for get_resources() was not symmetric with the registration step. The resulting inconsistency leaves stale references in kernel data structures.

Attack Vector

Exploitation requires local access with the ability to influence PCI resource allocation for a saa7164-supported device. An attacker with sufficient privileges to trigger probe failure conditions can force the dangling list entry and drive follow-on kernel memory operations that touch freed memory. Refer to the upstream commits for the exact source diff and reachability details.

Detection Methods for CVE-2026-89877

Indicators of Compromise

Kernel oops, general protection fault, or KASAN: use-after-free reports referencing saa7164_devlist or saa7164_dev_setup
dmesg entries showing repeated saa7164 probe failures followed by list traversal panics
Unexpected reloads of the saa7164 module coinciding with system instability

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test systems to surface use-after-free access on the global device list
Audit installed kernel packages against distribution advisories referencing the fix commits listed under kernel.org stable commits
Inventory hosts with saa7164-based PCIe tuners loaded via lsmod | grep saa7164

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a centralized log store and alert on saa7164 fault signatures
Track kernel version drift across the fleet to confirm patched builds are deployed
Monitor PCI device probe failures and correlate with subsequent kernel instability events

How to Mitigate CVE-2026-89877

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry as soon as vendor builds are available
On systems that do not require SAA7164-based tuner hardware, blacklist the saa7164 module to remove the attack surface
Restrict local access to trusted administrators to reduce the practical exploitation window

Patch Information

The fix is distributed across the following upstream commits on git.kernel.org: commit 28e84c6e, commit 4d204846, commit 69259c62, commit 77f216f8, commit daa5b32c, and commit fc656235. Apply your distribution's kernel update that incorporates these commits.

Workarounds

Blacklist the saa7164 module on hosts that do not use SAA7164 tuner hardware by adding blacklist saa7164 to /etc/modprobe.d/blacklist-saa7164.conf
Physically remove unused SAA7164-based PCIe cards from hosts to eliminate probe execution
Enforce least-privilege access controls to limit local users capable of influencing kernel module load and PCI resource allocation

bash

# Configuration example: blacklist the vulnerable module until patched
echo "blacklist saa7164" | sudo tee /etc/modprobe.d/blacklist-saa7164.conf
sudo depmod -a
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep saa7164 || echo "saa7164 not loaded"