In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered video_device twice zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that release callback, which kfree()s the video_device. zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device teardown could free the same video_device twice. Remove the direct kfree() and clear the cached pointer after unregistering. The pre-registration failure path keeps its manual free because the video_device was not registered there. This issue was found by a static analysis checker and confirmed by manual source review.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - media: zoran: Avoid freeing a registered video_device twice zoran_init_video_device() installs     zoran_vdev_release() as the video_device release callback through zoran_template. After     video_register_device() succeeds, video_unregister_device() drops the registered video_device reference     and the V4L2 core eventually invokes that release callback, which kfree()s the video_device.
    zoran_exit_video_devices() called video_unregister_device() and then kfree(zr->video_dev), so device     teardown could free the same video_device twice. Remove the direct kfree() and clear the cached pointer     after unregistering. The pre-registration failure path keeps its manual free because the video_device was     not registered there. This issue was found by a static analysis checker and confirmed by manual source     review. (CVE-2026-89870)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
366919	Debian dla-4841 : ata-modules-6.1.0-53-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
366749	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4687-1)	Nessus	SuSE Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
346602	Linux Distros Unpatched Vulnerability : CVE-2026-89870	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-89870

high

Tenable Plugins

high

high

high

high

high