CVE-2026-89887 (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, but then called ov7740_free_controls() which invokes both of them a second time, resulting in a double-free. This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740_free_controls() to safely tear down the mutex and control handler in the correct order.

Is your site exposed to CVE-2026-89887?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Other References

https://git.kernel.org/stable/c/09453b467990e8ef8fe09f45a685f9a625248d33 https://git.kernel.org/stable/c/25e2505866c577db2661e4d431f0907c6ec9a3b4 https://git.kernel.org/stable/c/5d1b3dea5a44124bab6c14a2d71b977dabed54e7 https://git.kernel.org/stable/c/7512838a19af0a284a58435292243fad21e57ff1 https://git.kernel.org/stable/c/81e9765878d3ac8ad18e3a683332b5d6bc3a0e33 https://git.kernel.org/stable/c/8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e https://git.kernel.org/stable/c/9e4693436c7dcf8584002500ce4b434b79bbf9ed https://git.kernel.org/stable/c/af81f35e4f429e769b784754e1aa4d7a922470ac

Frequently Asked Questions

What is CVE-2026-89887? +

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, but then called ov7740_free_controls() which invokes both of them a second time, resulting in a double-free. This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740_free_controls() to safely tear down the mutex and control handler in the correct order. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-89887? +

CVE-2026-89887 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

How do I check if I'm vulnerable to CVE-2026-89887? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-89887

Description

CVSS v3.1 Score

References

Other References

Frequently Asked Questions

Don't wait for an exploit