CVE-2026-89877

media: saa7164: fix cleanup on resource allocation failure

HIGH
8.4
CVSS Score
Published: September 16, 2026 at 10:31 AM UTC
Updated: October 19, 2026 at 09:18 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.4
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. If get_resources() fails, saa7164_dev_setup() decrements the device count and returns an error, but leaves the device on saa7164_devlist. The probe error path then frees the device, leaving a dangling entry on the global list. Reuse the existing MMIO mapping error path to remove the device from saa7164_devlist and decrement the device count before returning. Also release BAR0 if it was successfully requested but the BAR2 request fails.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

2.6.32443c1228d50518f3c550e1fef490a2c9d9246ce7
Vendor states this is fixed in 28e84c6e2e6753ed238ea097b2842a32a6a6879b (fixed)
Vendor states this is fixed in 4d2048466af9e2c960c5be6dcd317e3b657d268b (fixed)
Vendor states this is fixed in 69259c627009bf7621010ae9e997dad2dad3339c (fixed)
Vendor states this is fixed in 77f216f8de6221efb6f6c471bc9e598f1879825b (fixed)
Vendor states this is fixed in daa5b32cdf7db81a07ee2a91ce092a363e7754aa (fixed)
Vendor states this is fixed in fc65623524b5bf23baddc6ae688d954fba0d5de2 (fixed)
Vendor states this is fixed in 2.6.32 (unaffected)
Vendor states this is fixed in 6.1.188 (unaffected)
Vendor states this is fixed in 6.12.110 (unaffected)
Vendor states this is fixed in 6.18.51 (unaffected)
Vendor states this is fixed in 6.6.157 (unaffected)
Vendor states this is fixed in 7.2.5 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

CVSS

8.4HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card