From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6CE77503BF2 for ; Wed, 16 Sep 2026 10:39:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555206; cv=none; b=GHHidHmiNL69T6b9MwTDMSHBJtCPkvtLaQYDgUqJLkwMAD+92s1uFcXTB+giM7vcUhDx6nlljvZt/w90DsWYkdiPz1RmcaYFlXztnrZhBer1CBnEQpUkt+XWTvWtMg+AJLh1Kl/F3LK7UCEtWTHbIFR3zFYo3Y/ONtEXPey/+As= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555206; c=relaxed/simple; bh=DJQdVOJR6SWXDGERrb0DU/aVLhzfKiuD80HHwRiFU9Q=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=JsquUVQnwJiJbRHM8wwRJLYU+YBy/x+kdw4MnNazFphp43M1BYqhkTcHttRmTbwosh6lTEy5aYPMw8jDkqH+lGrCe9rDY4zpWuXhTkMNicz+LEraEiP1nNqMLQSV0ahKcHXad/5nJ/npEsUuS9fWIyZ+TsMoNHRix47v93Cqupc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aUQFkeBG; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="aUQFkeBG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 967DB1F00893; Wed, 16 Sep 2026 10:39:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789555169; bh=ldpj/3dV5Fh7jUYXAqbVIXwesdF9dNN3/7RSaE6BwEQ=; h=From:To:Cc:Subject:Date:Reply-To; b=aUQFkeBGyQQFvTCvn9kP57rovfCtwV9+5H5oWegBrlOSa5mGYuaOKm9+JPXy4xBK2 rWEe5/s604TDwHO2k5cJAn2Ix5rRH5g45OaJfHduVLMdKgZbMCjTDwppBlSC1pQr2q NLVUPaYySuQ9i61ORkRquMBf4rMwOmcGYgs0n2ZE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89887: media: i2c: ov7740: fix use-after-destroy in remove Date: Wed, 16 Sep 2026 11:30:17 +0100 Message-ID: <2026091634-CVE-2026-89887-e243@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3758; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=yLc0zlYDATdTvNn/JWPX3K3M/QytzxMmoLEYCQgi4yU=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmr8vtkMytbpPti2mZNMLhXfv+1oa12V5rswuBHU3483 tPu7XOwI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACZSVs+woHcu4y0eppaDq/M7 XvD+Sl9aqXcuhmGuQIXp4nN77wU9r11UFWXt/1h4E+dkAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, but then called ov7740_free_controls() which invokes both of them a second time, resulting in a double-free. This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740_free_controls() to safely tear down the mutex and control handler in the correct order. The Linux kernel CVE team has assigned CVE-2026-89887 to this issue. Affected and fixed versions =========================== Issue introduced in 4.16 with commit 39c5c4471b8d793daf868bd004e56ed420e89707 and fixed in 5.10.270 with commit 9e4693436c7dcf8584002500ce4b434b79bbf9ed Issue introduced in 4.16 with commit 39c5c4471b8d793daf868bd004e56ed420e89707 and fixed in 5.15.221 with commit 81e9765878d3ac8ad18e3a683332b5d6bc3a0e33 Issue introduced in 4.16 with commit 39c5c4471b8d793daf868bd004e56ed420e89707 and fixed in 6.1.188 with commit 8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e Issue introduced in 4.16 with commit 39c5c4471b8d793daf868bd004e56ed420e89707 and fixed in 6.6.157 with commit 7512838a19af0a284a58435292243fad21e57ff1 Issue introduced in 4.16 with commit 39c5c4471b8d793daf868bd004e56ed420e89707 and fixed in 6.12.110 with commit 25e2505866c577db2661e4d431f0907c6ec9a3b4 Issue introduced in 4.16 with commit 39c5c4471b8d793daf868bd004e56ed420e89707 and fixed in 6.18.51 with commit af81f35e4f429e769b784754e1aa4d7a922470ac Issue introduced in 4.16 with commit 39c5c4471b8d793daf868bd004e56ed420e89707 and fixed in 7.2.5 with commit 09453b467990e8ef8fe09f45a685f9a625248d33 Issue introduced in 4.16 with commit 39c5c4471b8d793daf868bd004e56ed420e89707 and fixed in 7.3-rc1 with commit 5d1b3dea5a44124bab6c14a2d71b977dabed54e7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89887 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/media/i2c/ov7740.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9e4693436c7dcf8584002500ce4b434b79bbf9ed https://git.kernel.org/stable/c/81e9765878d3ac8ad18e3a683332b5d6bc3a0e33 https://git.kernel.org/stable/c/8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e https://git.kernel.org/stable/c/7512838a19af0a284a58435292243fad21e57ff1 https://git.kernel.org/stable/c/25e2505866c577db2661e4d431f0907c6ec9a3b4 https://git.kernel.org/stable/c/af81f35e4f429e769b784754e1aa4d7a922470ac https://git.kernel.org/stable/c/09453b467990e8ef8fe09f45a685f9a625248d33 https://git.kernel.org/stable/c/5d1b3dea5a44124bab6c14a2d71b977dabed54e7