CVE-2026-89887 Overview
CVE-2026-89887 is a use-after-destroy flaw in the Linux kernel's ov7740 I2C camera sensor driver. The ov7740_remove() function destroys the driver's mutex before freeing the V4L2 control handler that depends on it. This teardown-order bug triggers a kernel panic on device removal. The driver also calls v4l2_ctrl_handler_free() and mutex_destroy() directly, then re-invokes both through ov7740_free_controls(), causing a double-free. A local, low-privileged user with the ability to trigger driver unbind or module unload can crash the system or corrupt kernel memory.
Critical Impact
Local low-privileged users can trigger a kernel panic or memory corruption through the ov7740 driver's remove path, impacting confidentiality, integrity, and availability of the host.
Affected Products
- Linux kernel builds that compile the media: i2c: ov7740 OmniVision camera sensor driver
- Systems using the OV7740 image sensor over I2C with V4L2 subdevice registration
- Distributions shipping kernels prior to the fixes referenced in the stable-tree commits
Discovery Timeline
- 2026-09-16 - CVE-2026-89887 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89887
Vulnerability Analysis
The defect resides in drivers/media/i2c/ov7740.c within the ov7740_remove() teardown routine. The driver invokes v4l2_ctrl_handler_free() on the control handler, then calls mutex_destroy() on the mutex that the handler internally references for locking. It subsequently calls ov7740_free_controls(), which repeats both operations. The result is two failure modes on the same code path: a use-after-destroy against the mutex and a double-free of the control handler resources. Both conditions occur inside kernel context and reliably produce a kernel panic when the driver is unbound, the module unloaded, or the underlying I2C device disconnected. Successful exploitation impacts host availability and can be leveraged for kernel memory corruption.
Root Cause
The root cause is an incorrect teardown order combined with duplicate cleanup calls. v4l2_ctrl_handler_free() dereferences the control handler's associated lock during finalization, so destroying that mutex first leaves subsequent operations pointing at freed lock state. The redundant call to ov7740_free_controls() then re-executes the same destructors, producing the double-free. This falls under improper resource release and locking lifecycle management in driver removal.
Attack Vector
An attacker requires local access with permissions to trigger driver unbind through sysfs (for example, writing to /sys/bus/i2c/drivers/ov7740/unbind), unload the kernel module via rmmod, or physically detach the sensor on hotpluggable hardware. No user interaction beyond the removal trigger is needed. Because the fault path is deterministic, a local user with the required capability can reliably crash the kernel or attempt to steer the freed memory into a controlled allocation for further exploitation.
No verified public exploit code is available. See the referenced Linux Kernel Commit 09453b4 and related stable-tree commits for the corrected teardown sequence.
Detection Methods for CVE-2026-89887
Indicators of Compromise
- Kernel panic or BUG: messages referencing ov7740_remove, v4l2_ctrl_handler_free, or mutex_destroy in dmesg and /var/log/kern.log.
- KASAN reports flagging use-after-free or double-free events within the media/i2c/ov7740 module.
- Unexpected process crashes or system reboots correlated with I2C device unbind or rmmod ov7740 events.
Detection Strategies
- Monitor kernel ring buffer output for oops signatures tied to the ov7740 driver during device removal or module unload.
- Audit privileged writes to /sys/bus/i2c/drivers/ov7740/unbind and module unload activity via auditd rules on init_module, finit_module, and delete_module syscalls.
- Correlate host availability incidents with V4L2 subdevice teardown events across fleets running affected kernels.
Monitoring Recommendations
- Ingest dmesg, journald, and auditd telemetry into a centralized analytics platform to alert on kernel panic patterns across managed Linux hosts.
- Track kernel version inventory to identify systems missing the stable-tree commits fixing the ov7740 teardown path.
- Enable KASAN on test and staging kernels used for driver validation to catch regressions in resource cleanup order.
How to Mitigate CVE-2026-89887
Immediate Actions Required
- Apply the stable kernel updates that include the ov7740 remove-path fix from the referenced upstream commits.
- Restrict local access to hosts using the OV7740 sensor and limit CAP_SYS_MODULE and root-equivalent capabilities that permit driver unbind or module unload.
- If the sensor is not in use, blacklist the ov7740 module via /etc/modprobe.d/ to prevent it from loading.
Patch Information
The fix reorders teardown so the V4L2 subdevice is unregistered first, then relies exclusively on ov7740_free_controls() to release the control handler and destroy the mutex in the correct order. Corrected code is available in the following stable-tree commits: Linux Kernel Commit 09453b4, Linux Kernel Commit 25e2505, Linux Kernel Commit 5d1b3de, Linux Kernel Commit 7512838, Linux Kernel Commit 81e9765, Linux Kernel Commit 8a02ee6, Linux Kernel Commit 9e46934, and Linux Kernel Commit af81f35.
Workarounds
- Blacklist the ov7740 module on systems that do not require the OmniVision OV7740 sensor to eliminate the vulnerable code path.
- Remove world-writable or overly permissive access to I2C sysfs unbind entries and enforce restrictive sudoers policies for module operations.
- Avoid unbinding or unloading the ov7740 driver on production hosts until the patched kernel is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
