{"id":"CVE-2026-72484","summary":"staging: most: video: avoid double free on video register failure","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: most: video: avoid double free on video register failure\n\ncomp_register_videodev() allocates a video_device with\nvideo_device_alloc() and releases it if video_register_device() fails.\n\nThis can double free the video_device when __video_register_device()\nreaches device_register() and that call fails:\n\n  video_register_device()\n    -\u003e __video_register_device()\n       -\u003e device_register() fails\n          -\u003e put_device(&vdev-\u003edev)\n             -\u003e v4l2_device_release()\n                -\u003e vdev-\u003erelease(vdev)\n                   -\u003e video_device_release(vdev)\n\n  comp_register_videodev()\n    -\u003e video_device_release(mdev-\u003evdev)\n\nUse video_device_release_empty() while registering the device so that\nregistration failure paths do not free mdev-\u003evdev through vdev-\u003erelease().\ncomp_register_videodev() then releases mdev-\u003evdev exactly once on failure.\nRestore video_device_release() after successful registration so the\nregistered device keeps its normal lifetime handling.\n\nThis issue was found by a static analysis tool I am developing.","modified":"2026-08-18T03:31:12.838526508Z","published":"2026-08-15T05:57:21.528Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72484.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/009d58b73500d0b49f6ae3833f8afcb0ebd9ddbb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/43078449ad6236d839e4d707954d2e36b10a6706"},{"type":"WEB","url":"https://git.kernel.org/stable/c/430ad4ea06a0767fb44a08e2212ceb3a996607ee"},{"type":"WEB","url":"https://git.kernel.org/stable/c/46ea51f5b2ee1a3b40c05b7c750cbc5cabe94062"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4928096212b78262dbbeab3b3abf2352278ce22d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7cb1c5b32a2bfde961fff8d5204526b609bcb30a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7fc162453cfb7b8e93edb16287a84ba0130cac38"},{"type":"WEB","url":"https://git.kernel.org/stable/c/80ed79787da3311f76b4d71d0ce7ab992a9e134d"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72484.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72484"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"eab231c0398a91fbd294672bfe9e0ff45b368246"},{"fixed":"009d58b73500d0b49f6ae3833f8afcb0ebd9ddbb"},{"fixed":"430ad4ea06a0767fb44a08e2212ceb3a996607ee"},{"fixed":"46ea51f5b2ee1a3b40c05b7c750cbc5cabe94062"},{"fixed":"4928096212b78262dbbeab3b3abf2352278ce22d"},{"fixed":"80ed79787da3311f76b4d71d0ce7ab992a9e134d"},{"fixed":"43078449ad6236d839e4d707954d2e36b10a6706"},{"fixed":"7fc162453cfb7b8e93edb16287a84ba0130cac38"},{"fixed":"7cb1c5b32a2bfde961fff8d5204526b609bcb30a"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72484.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"5.10.261"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.212"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72484.json"}}],"schema_version":"1.9.0"}