Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered video_device twice zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that release callback, which kfree()s the video_device. zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device teardown could free the same video_device twice. Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the video_device was not registered there. This issue was found by a static analysis checker and confirmed by manual source review.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 82e3a496eb56da0b9f29fdc5b63cedb3289e91de before 3ad6cf27505017a6794f5f96c31218c2291e951b; affected 82e3a496eb56da0b9f29fdc5b63cedb3289e91de before c4acac8cdc005b2d14b6cef5e215d264212857f3; affected 82e3a496eb56da0b9f29fdc5b63cedb3289e91de before 4d99d8d0d895489064783601a516bd45812fa992; affected 82e3a496eb56da0b9f29fdc5b63cedb3289e91de before f1c4f3885df1f09bcab5296d86834d104f865e86; affected 82e3a496eb56da0b9f29fdc5b63cedb3289e91de before 672dbccf4351370dad002d3c78dbb29ca1588f22; affected 82e3a496eb56da0b9f29fdc5b63cedb3289e91de before 0735e0b5a96761a9ce277a238e834008ad92a0a5; affected bd01629315ffd5b63da91d0bd529a77d30e55028; affected ff3357bffd9fb78f59762d8955afc7382a279079; affected c1ba65100a359fe28cfe37e09e10c99f247cbf1e; affected 1e501ec38796f43e995731d1bcd4173cb1ccfce0; affected 5.10.110 before 5.11; affected 5.15.33 before 5.16; affected 5.16.19 before 5.17; affected 5.17.2 before 5.18 |
| Linux / Linux | affected 5.18; unaffected 0 before 5.18; unaffected 6.1.188 through 6.1.*; unaffected 6.6.157 through 6.6.*; unaffected 6.12.110 through 6.12.*; unaffected 6.18.51 through 6.18.*; unaffected 7.2.5 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/3ad6cf27505017a6794f5f96c31218c2291e951b
- https://git.kernel.org/stable/c/c4acac8cdc005b2d14b6cef5e215d264212857f3
- https://git.kernel.org/stable/c/4d99d8d0d895489064783601a516bd45812fa992
- https://git.kernel.org/stable/c/f1c4f3885df1f09bcab5296d86834d104f865e86
- https://git.kernel.org/stable/c/672dbccf4351370dad002d3c78dbb29ca1588f22
- https://git.kernel.org/stable/c/0735e0b5a96761a9ce277a238e834008ad92a0a5