CVE-2026-89870

7.8 HIGH

Published 2026-09-16 · Updated 2026-09-16

AI risk analysis

Summary: The flaw allows for potential double-free conditions in the Linux kernel, leading to instability or security issues.
Exploitability: Exploitation requires kernel-level access and specific timing conditions, making it moderately difficult.
Blast radius: If exploited, it could lead to system crashes or privilege escalation, depending on the context.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the specific version mentioned: 'Upgrade to 5.10.100 or later'.

kernelstabilityprivilege-escalation

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered video_device twice zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that release callback, which kfree()s the video_device. zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device teardown could free the same video_device twice. Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the video_device was not registered there. This issue was found by a static analysis checker and confirmed by manual source review.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.