CVE-2026-89741

A flaw was found in the Linux kernel's media subsystem, specifically within the v4l2-dev component. This vulnerability arises from incorrect error handling in the __video_register_device() function. If a device registration fails, the system attempts to free the same memory region twice, leading to a double-free condition. This type of flaw can result in system instability, memory corruption, or a denial of service (DoS).

A double free can occur in the V4L2 device registration error path when device_register() fails after the earlier error handling change. The problematic path may call put_device() and free the video_device object, while the V4L2 API still expects the caller to call video_device_release() after video_register_device() failure, freeing the same object again. For the CVSS the PR:L is used in the paranoid score because reduced capability root, container root, or a service account that can trigger media device registration may be enough in some deployments. The issue is local and not directly network reachable. Impact is at least denial of service via kernel memory corruption and in the worst case may allow confidentiality or integrity impact including privilege escalation. Reliable exploitation is likely difficult because it depends on making device_register() fail during a V4L2 registration path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.