---
id: CVE-2026-89896
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: cedrus: fix memory leak in cedrus_init_ctrls()

  In cedrus_init_ctrls(), the V4L2 control handler is initialized before
  allocating memory for ctx->ctrls
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: cedrus: fix memory leak in cedrus_init_ctrls()

  In cedrus_init_ctrls(), the V4L2 control handler is initialized before
  allocating memory for ctx->ctrls. If this …
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1 <
    6fabacc3b79a528450aef4c32464da2ec681049e
  - >-
    Linux >= 50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1 <
    729a1ffab968b3c493f61d1cd683f5bafec500ea
  - >-
    Linux >= 50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1 <
    ce5693b6e3a693fcdc3800af309363f6250104c8
  - >-
    Linux >= 50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1 <
    22441be29ec27c693f40c1ef499093275ef529d1
  - >-
    Linux >= 50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1 <
    79fd0b0161506fc9507bf7a6fe4c975a857a5be8
  - >-
    Linux >= 50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1 <
    f78cf36cabf911da348ea80e4e9f430d74f6905c
  - >-
    Linux >= 50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1 <
    81aa608ac3a56cdd4aab0bd12442ed529a24ba31
  - >-
    Linux >= 50e761516f2b8c0cdeb31a8c6ca1b4ef98cd13f1 <
    9df2fbe563194da1967a5db083442186c1323efe
  - Linux 4.20
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T11:16:58.400'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89896'
references:
  - url: 'https://git.kernel.org/stable/c/22441be29ec27c693f40c1ef499093275ef529d1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6fabacc3b79a528450aef4c32464da2ec681049e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/729a1ffab968b3c493f61d1cd683f5bafec500ea'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/79fd0b0161506fc9507bf7a6fe4c975a857a5be8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/81aa608ac3a56cdd4aab0bd12442ed529a24ba31'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9df2fbe563194da1967a5db083442186c1323efe'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ce5693b6e3a693fcdc3800af309363f6250104c8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f78cf36cabf911da348ea80e4e9f430d74f6905c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89896.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89896'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2535119'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89896'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89896'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89896.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-09-16T10:53:53.980Z'
epss: 0.00211
epssPercentile: 0.11209
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-772
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: cedrus: fix memory leak in cedrus_init_ctrls()

In cedrus_init_ctrls(), the V4L2 control handler is initialized before
allocating memory for ctx->ctrls. If this allocation fails, the function
returns -ENOMEM without freeing the previously allocated handler
resources, leading to a memory leak.

Fix this by calling v4l2_ctrl_handler_free() on the ctx->ctrls allocation
failure path.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1.1.

An x86_64 allyesconfig build showed no new warnings. As we do not have an
Allwinner SoC or board with a Cedrus VPU available to test with, no
runtime testing was able to be performed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89896.json)