CVE-2026-89741

The Linux kernel's V4L2 subsystem contains a double-free in __video_register_device(): a prior fix (commit 2a934fdb01db) added a put_device() call when device_register fails, but the V4L2 API contract requires drivers to call video_device_release() on registration failure, which kfree()s the same video_device struct that put_device() already freed. A local attacker with low privileges who can cause video_register_device() to fail (for example, by exhausting the resource needed for device registration) triggers the double free, which can corrupt kernel heap memory and potentially lead to privilege escalation or kernel code execution (CVSS 7.8, local, high C/I/A impact). Affected systems are those running kernel releases that contained the faulty commit 2a934fdb01db and that use V4L2 video drivers; the upstream resolution reverts the bad fix, trading the double-free for a small, benign memory leak. No public proof-of-concept or in-the-wild exploitation is known, and the maintainers note that device_register failures are themselves unlikely, making real-world exploitability limited.

What to do: Upgrade to a kernel that includes this revert (or a distro kernel package carrying it) as part of routine kernel patching — no urgent out-of-band action is warranted given no known exploitation and the low likelihood of device_register failing. As defense-in-depth, restrict untrusted local shell access, and consider blacklisting unused V4L2/video kernel modules on servers and appliances that don't need camera or capture device support. Watch for kernel oops/heap-corruption reports originating from video device registration paths as an indicator of probing.