High 7.8Published Sep 16, 2026

CVE-2026-89887media: i2c: ov7740: fix use-after-destroy in remove

Updated under an hour ago (Oct 27, 2026, 4:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, but then called ov7740_free_controls() which invokes both of them a second time, resulting in a double-free. This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740_free_controls() to safely tear down the mutex and control handler in the correct order.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	39c5c4471b8d793daf868bd004e56ed420e89707 builds before 9e4693436c7dcf8584002500ce4b434b79bbf9ed; from 39c5c4471b8d793daf868bd004e56ed420e89707 before 81e9765878d3ac8ad18e3a683332b5d6bc3a0e33; 39c5c4471b8d793daf868bd004e56ed420e89707 builds before 8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e; from 39c5c4471b8d793daf868bd004e56ed420e89707 before 7512838a19af0a284a58435292243fad21e57ff1; 39c5c4471b8d793daf868bd004e56ed420e89707 builds before 25e2505866c577db2661e4d431f0907c6ec9a3b4; from 39c5c4471b8d793daf868bd004e56ed420e89707 before af81f35e4f429e769b784754e1aa4d7a922470ac; from 39c5c4471b8d793daf868bd004e56ed420e89707 before 09453b467990e8ef8fe09f45a685f9a625248d33; 39c5c4471b8d793daf868bd004e56ed420e89707 builds before 5d1b3dea5a44124bab6c14a2d71b977dabed54e7	CNA record

References

References

https://git.kernel.org/stable/c/9e4693436c7dcf8584002500ce4b434b79bbf9ed
https://git.kernel.org/stable/c/81e9765878d3ac8ad18e3a683332b5d6bc3a0e33
https://git.kernel.org/stable/c/8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e
https://git.kernel.org/stable/c/7512838a19af0a284a58435292243fad21e57ff1
https://git.kernel.org/stable/c/25e2505866c577db2661e4d431f0907c6ec9a3b4
https://git.kernel.org/stable/c/af81f35e4f429e769b784754e1aa4d7a922470ac
https://git.kernel.org/stable/c/09453b467990e8ef8fe09f45a685f9a625248d33
https://git.kernel.org/stable/c/5d1b3dea5a44124bab6c14a2d71b977dabed54e7

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.