Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-15T00:00:00 kernel: staging: most: video: avoid double free on video register failure 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-1341

In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure comp_register_videodev() allocates a video_device with video_device_alloc() and releases it if video_register_device() fails. This can double free the video_device when __video_register_device() reaches device_register() and that call fails: video_register_device() -> __video_register_device() -> device_register() fails -> put_device(&vdev->dev) -> v4l2_device_release() -> vdev->release(vdev) -> video_device_release(vdev) comp_register_videodev() -> video_device_release(mdev->vdev) Use video_device_release_empty() while registering the device so that registration failure paths do not free mdev->vdev through vdev->release(). comp_register_videodev() then releases mdev->vdev exactly once on failure. Restore video_device_release() after successful registration so the registered device keeps its normal lifetime handling. This issue was found by a static analysis tool I am developing.

A flaw was found in the Linux kernel, specifically within the `staging: most: video` subsystem. This vulnerability occurs when `comp_register_videodev()` attempts to release a `video_device` that might have already been freed during a failed device registration. A local attacker could exploit this double free vulnerability, potentially leading to memory corruption or a denial of service (DoS).

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-72484 https://nvd.nist.gov/vuln/detail/CVE-2026-72484 https://lore.kernel.org/linux-cve-announce/2026081537-CVE-2026-72484-7370@gregkh/T