EUVD-2026-80487
GHSA-3687-g89h-mvw4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only teardown path reachable only via privileged unbind/physical removal (AV:L, PR:L, AC:H); impact is a kernel panic (A:H) with no real confidentiality (C:N) and only incidental memory corruption (I:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
media: i2c: ov7740: fix use-after-destroy in remove
The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, but then called ov7740_free_controls() which invokes both of them a second time, resulting in a double-free.
This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740_free_controls() to safely tear down the mutex and control handler in the correct order.
AnalysisAI
A teardown-order defect in the Linux kernel's ov7740 i2c camera-sensor driver causes a use-after-destroy and a double-free when the driver is unbound or the OmniVision OV7740 sensor is physically removed, panicking the kernel or otherwise taking the system down. Only systems that ship an OV7740 sensor with the CONFIG_VIDEO_OV7740 driver built or loaded are affected, so exposure is limited to specific embedded/SoC platforms. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ov7740 driver's remove()/teardown path to execute - reached only by unbinding the driver via sysfs (a root/privileged operation) or by physically removing the OmniVision OV7740 i2c camera sensor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a classic case of vendor CVSS over-scoring for a Linux kernel teardown-path memory-corruption bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51 or 7.2.5 on the corresponding stable branches, or to mainline 7.3-rc1; the fix commits are listed at https://git.kernel.org/stable/c/9e4693436c7dcf8584002500ce4b434b79bbf9ed, https://git.kernel.org/stable/c/81e9765878d3ac8ad18e3a683332b5d6bc3a0e33, https://git.kernel.org/stable/c/8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e, https://git.kernel.org/stable/c/7512838a19af0a284a58435292243fad21e57ff1, https://git.kernel.org/stable/c/25e2505866c577db2661e4d431f0907c6ec9a3b4, https://git.kernel.org/stable/c/af81f35e4f429e769b784754e1aa4d7a922470ac, https://git.kernel.org/stable/c/09453b467990e8ef8fe09f45a685f9a625248d33 and https://git.kernel.org/stable/c/5d1b3dea5a44124bab6c14a2d71b977dabed54e7, and the tracking record is available via EUVD-2026-80487 / https://nvd.nist.gov/vuln/detail/CVE-2026-89887. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems with the OmniVision OV7740 sensor and the CONFIG_VIDEO_OV7740 driver enabled, and record their kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today