---
id: CVE-2026-89877
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: saa7164: fix cleanup on resource allocation failure

  saa7164_dev_setup() adds the device to the global saa7164_devlist before
  requesting the PCI BAR memory regio…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: saa7164: fix cleanup on resource allocation failure

  saa7164_dev_setup() adds the device to the global saa7164_devlist before
  requesting the PCI BAR memory regio…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 443c1228d50518f3c550e1fef490a2c9d9246ce7 <
    daa5b32cdf7db81a07ee2a91ce092a363e7754aa
  - >-
    Linux >= 443c1228d50518f3c550e1fef490a2c9d9246ce7 <
    77f216f8de6221efb6f6c471bc9e598f1879825b
  - >-
    Linux >= 443c1228d50518f3c550e1fef490a2c9d9246ce7 <
    69259c627009bf7621010ae9e997dad2dad3339c
  - >-
    Linux >= 443c1228d50518f3c550e1fef490a2c9d9246ce7 <
    4d2048466af9e2c960c5be6dcd317e3b657d268b
  - >-
    Linux >= 443c1228d50518f3c550e1fef490a2c9d9246ce7 <
    fc65623524b5bf23baddc6ae688d954fba0d5de2
  - >-
    Linux >= 443c1228d50518f3c550e1fef490a2c9d9246ce7 <
    28e84c6e2e6753ed238ea097b2842a32a6a6879b
  - Linux 2.6.32
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:14.570'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89877'
references:
  - url: 'https://git.kernel.org/stable/c/28e84c6e2e6753ed238ea097b2842a32a6a6879b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4d2048466af9e2c960c5be6dcd317e3b657d268b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/69259c627009bf7621010ae9e997dad2dad3339c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/77f216f8de6221efb6f6c471bc9e598f1879825b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/daa5b32cdf7db81a07ee2a91ce092a363e7754aa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fc65623524b5bf23baddc6ae688d954fba0d5de2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.986Z'
epss: 0.00196
epssPercentile: 0.08202
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: saa7164: fix cleanup on resource allocation failure

saa7164_dev_setup() adds the device to the global saa7164_devlist before
requesting the PCI BAR memory regions.

If get_resources() fails, saa7164_dev_setup() decrements the device count
and returns an error, but leaves the device on saa7164_devlist. The probe
error path then frees the device, leaving a dangling entry on the global
list.

Reuse the existing MMIO mapping error path to remove the device from
saa7164_devlist and decrement the device count before returning.

Also release BAR0 if it was successfully requested but the BAR2 request
fails.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.