CVE-2026-72484

Received Received - Intake

Double Free in Linux Kernel Video Device

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure comp_register_videodev() allocates a video_device with video_device_alloc() and releases it if video_register_device() fails. This can double free the video_device when __video_register_device() reaches device_register() and that call fails: video_register_device() -> __video_register_device() -> device_register() fails -> put_device(&vdev->dev) -> v4l2_device_release() -> vdev->release(vdev) -> video_device_release(vdev) comp_register_videodev() -> video_device_release(mdev->vdev) Use video_device_release_empty() while registering the device so that registration failure paths do not free mdev->vdev through vdev->release(). comp_register_videodev() then releases mdev->vdev exactly once on failure. Restore video_device_release() after successful registration so the registered device keeps its normal lifetime handling. This issue was found by a static analysis tool I am developing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72484

EUVD

EUVD-2026-59383

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a double free issue in the staging most video subsystem. When registering a video device fails, the code attempts to free the device twice: once during the registration failure path and again in the cleanup function. This happens because the device release handler is called through two different paths, leading to a use-after-free or memory corruption scenario.

Detection Guidance

This vulnerability is specific to the Linux kernel's staging:most video driver and involves a double-free issue during video device registration. Detection requires checking the kernel version and examining the affected driver code. No direct network detection commands are applicable. Inspect kernel logs for crashes or use kernel debugging tools like ftrace or KASAN to identify double-free events in the video device subsystem.

Impact Analysis

This vulnerability could lead to system instability, crashes, or potential privilege escalation if exploited. It may cause memory corruption, allowing attackers to execute arbitrary code or disrupt services running on affected systems. Users should update their Linux kernel to a patched version to mitigate this risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory management issue in the Linux kernel's staging driver subsystem that could lead to a double-free error during video device registration failure. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this double free issue in the staging most video subsystem. Monitor kernel updates from your distribution vendor and apply them promptly.

Hi! I’m here to help you understand CVE-2026-72484. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70