CVE-2026-89877 (CVSS 8.4)

Description

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. If get_resources() fails, saa7164_dev_setup() decrements the device count and returns an error, but leaves the device on saa7164_devlist. The probe error path then frees the device, leaving a dangling entry on the global list. Reuse the existing MMIO mapping error path to remove the device from saa7164_devlist and decrement the device count before returning. Also release BAR0 if it was successfully requested but the BAR2 request fails.

Is your site exposed to CVE-2026-89877?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.4

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Other References

https://git.kernel.org/stable/c/28e84c6e2e6753ed238ea097b2842a32a6a6879b https://git.kernel.org/stable/c/4d2048466af9e2c960c5be6dcd317e3b657d268b https://git.kernel.org/stable/c/69259c627009bf7621010ae9e997dad2dad3339c https://git.kernel.org/stable/c/77f216f8de6221efb6f6c471bc9e598f1879825b https://git.kernel.org/stable/c/daa5b32cdf7db81a07ee2a91ce092a363e7754aa https://git.kernel.org/stable/c/fc65623524b5bf23baddc6ae688d954fba0d5de2

Frequently Asked Questions

What is CVE-2026-89877? +

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. If get_resources() fails, saa7164_dev_setup() decrements the device count and returns an error, but leaves the device on saa7164_devlist. The probe error path then frees the device, leaving a dangling entry on the global list. Reuse the existing MMIO mapping error path to remove the device from saa7164_devlist and decrement the device count before returning. Also release BAR0 if it was successfully requested but the BAR2 request fails. It has a CVSS v3.1 base score of 8.4 (HIGH).

How severe is CVE-2026-89877? +

CVE-2026-89877 has a CVSS v3.1 score of 8.4 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

How do I check if I'm vulnerable to CVE-2026-89877? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-89877

Description

CVSS v3.1 Score

References

Other References

Frequently Asked Questions

Don't wait for an exploit