CVE-2026-72484

A flaw was found in the Linux kernel, specifically within the staging: most: video subsystem. This vulnerability occurs when comp_register_videodev() attempts to release a video_device that might have already been freed during a failed device registration. A local attacker could exploit this double free vulnerability, potentially leading to memory corruption or a denial of service (DoS).

A flaw of Moderate impact was found in the Linux kernel staging MOST (Media Oriented Systems Transport) video driver. In comp_register_videodev(), when video_register_device() fails after the internal device_register() call has already released the video_device through the V4L2 device release path, comp_register_videodev() releases the same video_device again, resulting in a double free. A local attacker able to trigger this device registration failure path could exploit the double free to cause memory corruption, leading to a kernel panic and denial of service. This flaw has been rated Moderate severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). All currently assessed Red Hat product streams (Red Hat Enterprise Linux kernel and kernel-rt, and Red Hat In-Vehicle OS kernel and kernel-ivos-qualcomm) are not affected because the vulnerable code in the upstream drivers/staging/most/video driver is not present in the Red Hat shipped kernel packages, so no Red Hat product update is required for this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.