EUVD-2026-80477
GHSA-33q9-xpr9-fmxv
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local probe-time error path that is not attacker-controlled gives AV:L/AC:H/PR:L; impact is a dangling-list UAF that is DoS/corruption-oriented, so C:N and only I:L/A:L.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
media: saa7164: fix cleanup on resource allocation failure
saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions.
If get_resources() fails, saa7164_dev_setup() decrements the device count and returns an error, but leaves the device on saa7164_devlist. The probe error path then frees the device, leaving a dangling entry on the global list.
Reuse the existing MMIO mapping error path to remove the device from saa7164_devlist and decrement the device count before returning.
Also release BAR0 if it was successfully requested but the BAR2 request fails.
AnalysisAI
The Linux kernel's saa7164 media driver can leave a freed device structure dangling on the global saa7164_devlist when PCI BAR memory-region allocation fails during probe, because saa7164_dev_setup() adds the device to the list before calling get_resources() and never removes it on that error path; the probe cleanup then frees the device while the global list still points at it. Affected systems are those running the saa7164 driver against an SAA7164-based (NXP/Philips) TV capture card such as a Hauppauge HVR-22xx, and effectively any kernel built with CONFIG_VIDEO_SAA7164; the flaw was introduced with commit 443c1228d50518f3c550e1fef490a2c9d9246ce7 and is fixed in Linux 6.1.188, 6.6.157, 6.12.110, 6.18.51 and 7.2.5 (mainline 7.3-rc1). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the saa7164 media driver to be loaded against a supported NXP/Philips SAA7164-based TV capture card (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is LOW despite a high vendor CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.1.188, 6.6.157, 6.12.110 or 6.18.51 on the corresponding stable branches (mainline fix in 7.3-rc1), or apply the stable backport commit for your branch from https://git.kernel.org/stable/c/daa5b32cdf7db81a07ee2a91ce092a363e7754aa, https://git.kernel.org/stable/c/77f216f8de6221efb6f6c471bc9e598f1879825b, https://git.kernel.org/stable/c/69259c627009bf7621010ae9e997dad2dad3339c, https://git.kernel.org/stable/c/4d2048466af9e2c960c5be6dcd317e3b657d268b, https://git.kernel.org/stable/c/fc65623524b5bf23baddc6ae688d954fba0d5de2 or https://git.kernel.org/stable/c/28e84c6e2e6753ed238ea097b2842a32a6a6879b; see also https://nvd.nist.gov/vuln/detail/CVE-2026-89877. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux hosts for the saa7164 driver (CONFIG_VIDEO_SAA7164) and SAA7164-based capture cards such as the Hauppauge HVR-22xx, since only systems with this driver loaded are exposed, and immediately blacklist or disable the driver where the hardware is not in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today