What is the CVSS score of CVE-2026-89870?

CVE-2026-89870 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Which versions of Linux Kernel are affected by CVE-2026-89870?

A double-free memory flaw in the Linux kernel's legacy zoran video-capture driver (CVE-2026-89870) could allow a local user to crash or corrupt kernel memory, but only on the small number of systems…. A patch is available.

How to fix or mitigate CVE-2026-89870?

Within 24 hours, confirm whether any production, lab, broadcast, or capture systems in the estate still bind the zoran V4L2 driver by checking loaded modules and PCI device inventories (look for ZR36057/ZR36067 cards such as Buz, DC10, or LML33-class hardware), and where the driver is present, restrict interactive local logon and sudo privileges to trusted administrators to reduce the authenticated-attacker surface implied by the CVSS PR:L vector. Within 7 days, schedule and deploy the vendor-released kernel patches to all identified affected hosts - upgrading to 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5, or 7.3-rc1 as appropriate to the running stable branch - and where patching must be deferred, blacklist or unbind the zoran module and defer any planned PCI removal, module unload, or hardware decommissioning on those hosts until the patch is applied. Within 30 days, verify patch compliance through configuration management or vulnerability scanning, retire or replace any remaining Zoran-based capture hardware that no longer serves a documented business function, and add legacy media/V4L2 driver review to the standard kernel maintenance cycle so similar obsolete-driver issues are caught and remediated routinely.

Linux Kernel CVE-2026-89870

EUVD-2026-80470 HIGH

2026-09-16 Linux

GHSA-vq76-xc8w-vp5g

Denial Of Service Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Local-only teardown path (AV:L), reaching it needs driver/device removal timing so AC:H, low-priv PR:L; impact is a double-free crash so A:H dominant with C:N and only incidental I:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 16:40 vuln.today

tag: Denial Of Service added

Metadata Corrected

Sep 16, 2026 - 16:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Sep 16, 2026 - 15:44 vuln.today

CVSS changed

Sep 16, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Sep 16, 2026 - 11:03 EUVD

CVE Published

Sep 16, 2026 - 10:31 cve.org

HIGH 7.8

CVE Published

Sep 16, 2026 - 10:31 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: zoran: Avoid freeing a registered video_device twice

zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that release callback, which kfree()s the video_device.

zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device teardown could free the same video_device twice.

Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the video_device was not registered there.

This issue was found by a static analysis checker and confirmed by manual source review.

AnalysisAI

Double-free in the Linux kernel's legacy zoran V4L2 media driver on teardown allows a local user who can trigger device/driver removal to kfree() the same registered video_device twice, crashing the kernel or corrupting kernel memory. Only systems where the zoran driver is bound to real Zoran ZR36057/ZR36067-based PCI MJPEG framegrabber hardware (Buz, DC10, LML33-class cards) are affected, and the flaw is reachable only through teardown paths such as module unload, PCI unbind/removal, or driver shutdown - not through normal runtime device I/O and not remotely. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires the zoran driver to be loaded against real Zoran ZR36057/ZR36067-based PCI MJPEG framegrabber hardware (Buz, DC10, LML33 class cards). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a locally-triggered double-free (CWE-415, the input's CWE is N/A) in the obsolete zoran V4L2 media driver's teardown path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: update to the fixed kernel for your branch - 6.1.188, 6.6.157, 6.12.110, 6.18.51, or 7.2.5 (fix also present in 7.3-rc1) - or cherry-pick the relevant stable commit (0735e0b5a96761a9ce277a238e834008ad92a0a5, 3ad6cf27505017a6794f5f96c31218c2291e951b, 672dbccf4351370dad002d3c78dbb29ca1588f22, 4d99d8d0d895489064783601a516bd45812fa992, c4acac8cdc005b2d14b6cef5e215d264212857f3, or f1c4f3885df1f09bcab5296d86834d104f865e86), which removes the redundant kfree() after video_unregister_device() in zoran_exit_video_devices() while retaining the manual free on the pre-registration failure path. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, confirm whether any production, lab, broadcast, or capture systems in the estate still bind the zoran V4L2 driver by checking loaded modules and PCI device inventories (look for ZR36057/ZR36067 cards such as Buz, DC10, or LML33-class hardware), and where the driver is present, restrict interactive local logon and sudo privileges to trusted administrators to reduce the authenticated-attacker surface implied by the CVSS PR:L vector. …

Threat intelligence, references, and detailed analysis are available after sign-in.