{"id":"CVE-2026-89896","revision":"38ce9940d8f44c8dbcac20896ed4f977","records":[{"revision":"38ce9940d8f44c8dbcac20896ed4f977","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89896","aliases":[],"title":"media: cedrus: fix memory leak in cedrus_init_ctrls()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cedrus: fix memory leak in cedrus_init_ctrls()\n\nIn cedrus_init_ctrls(), the V4L2 control handler is initialized before\nallocating memory for ctx->ctrls. If this allocation fails, the function\nreturns -ENOMEM without freeing the previously allocated handler\nresources, leading to a memory leak.\n\nFix this by calling v4l2_ctrl_handler_free() on the ctx->ctrls allocation\nfailure path.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1.1.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have an\nAllwinner SoC or board with a Cedrus VPU available to test with, no\nruntime testing was able to be performed.","state":0,"publishedAt":"2026-09-16T10:31:57.504+00:00","modifiedAt":"2026-10-19T08:54:29.201+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/staging/media/sunxi/cedrus/cedrus.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1\",\n                            \"lessThan\": \"6fabacc3b79a528450aef4c32464da2ec681049e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1\",\n                            \"lessThan\": \"729a1ffab968b3c493f61d1cd683f5bafec500ea\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1\",\n                            \"lessThan\": \"ce5693b6e3a693fcdc3800af309363f6250104c8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1\",\n                            \"lessThan\": \"22441be29ec27c693f40c1ef499093275ef529d1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1\",\n                            \"lessThan\": \"79fd0b0161506fc9507bf7a6fe4c975a857a5be8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1\",\n                            \"lessThan\": \"f78cf36cabf911da348ea80e4e9f430d74f6905c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1\",\n                            \"lessThan\": \"81aa608ac3a56cdd4aab0bd12442ed529a24ba31\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1\",\n                            \"lessThan\": \"9df2fbe563194da1967a5db083442186c1323efe\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/staging/media/sunxi/cedrus/cedrus.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.20\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.20\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/6fabacc3b79a528450aef4c32464da2ec681049e","https://git.kernel.org/stable/c/729a1ffab968b3c493f61d1cd683f5bafec500ea","https://git.kernel.org/stable/c/ce5693b6e3a693fcdc3800af309363f6250104c8","https://git.kernel.org/stable/c/22441be29ec27c693f40c1ef499093275ef529d1","https://git.kernel.org/stable/c/79fd0b0161506fc9507bf7a6fe4c975a857a5be8","https://git.kernel.org/stable/c/f78cf36cabf911da348ea80e4e9f430d74f6905c","https://git.kernel.org/stable/c/81aa608ac3a56cdd4aab0bd12442ed529a24ba31","https://git.kernel.org/stable/c/9df2fbe563194da1967a5db083442186c1323efe"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89896","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89896","identifiers":["CVE-2026-89896"]},"retained":false,"historicalAffected":[]}],"coverage":[]}