Linux Kernel CVE-2026-53379

The ov8856 is an OmniVision 8-megapixel CMOS image sensor used in select consumer and embedded Linux devices, connected via I2C and managed through the Video4Linux2 (V4L2) media subsystem. V4L2 uses a v4l2_ctrl_handler structure that must be explicitly released with v4l2_ctrl_handler_free() to reclaim associated kernel memory. CWE-908 (Use of Uninitialized Resource) describes this class of defect: a partially-initialized structure is abandoned without cleanup when an error occurs partway through setup, in this case inside ov8856_init_controls(). If any call to register a control (e.g., v4l2_ctrl_new_std()) fails, the original code returned early without freeing the handler, producing a kernel-space memory leak. The fix adds a proper error-exit label that ensures the handler is always freed on failure. Affected CPE is cpe:2.3:a:linux:linux:* across stable branches prior to the respective patch commits confirmed by EUVD-2026-45452.