High 8.4Published Sep 16, 2026

CVE-2026-89877media: saa7164: fix cleanup on resource allocation failure

Updated under an hour ago (Oct 27, 2026, 3:00 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. If get_resources() fails, saa7164_dev_setup() decrements the device count and returns an error, but leaves the device on saa7164_devlist. The probe error path then frees the device, leaving a dangling entry on the global list. Reuse the existing MMIO mapping error path to remove the device from saa7164_devlist and decrement the device count before returning. Also release BAR0 if it was successfully requested but the BAR2 request fails.

CVSS: 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 443c1228d50518f3c550e1fef490a2c9d9246ce7 before daa5b32cdf7db81a07ee2a91ce092a363e7754aa; 443c1228d50518f3c550e1fef490a2c9d9246ce7 builds before 77f216f8de6221efb6f6c471bc9e598f1879825b; from 443c1228d50518f3c550e1fef490a2c9d9246ce7 before 69259c627009bf7621010ae9e997dad2dad3339c; 443c1228d50518f3c550e1fef490a2c9d9246ce7 builds before 4d2048466af9e2c960c5be6dcd317e3b657d268b; from 443c1228d50518f3c550e1fef490a2c9d9246ce7 before fc65623524b5bf23baddc6ae688d954fba0d5de2; 443c1228d50518f3c550e1fef490a2c9d9246ce7 builds before 28e84c6e2e6753ed238ea097b2842a32a6a6879b	CNA record

References

References

https://git.kernel.org/stable/c/daa5b32cdf7db81a07ee2a91ce092a363e7754aa
https://git.kernel.org/stable/c/77f216f8de6221efb6f6c471bc9e598f1879825b
https://git.kernel.org/stable/c/69259c627009bf7621010ae9e997dad2dad3339c
https://git.kernel.org/stable/c/4d2048466af9e2c960c5be6dcd317e3b657d268b
https://git.kernel.org/stable/c/fc65623524b5bf23baddc6ae688d954fba0d5de2
https://git.kernel.org/stable/c/28e84c6e2e6753ed238ea097b2842a32a6a6879b

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.