{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  staging: most: video: avoid double free on video register failure  comp_register_videodev() allocates a video_device with video_device_alloc() and releases it if video_register_device() fails.  This can double free the video_device when __video_register_device() reaches device_register() and that call fails:    video_register_device()     -\u003e __video_register_device()        -\u003e device_register() fails           -\u003e put_device(\u0026vdev-\u003edev)              -\u003e v4l2_device_release()                 -\u003e vdev-\u003erelease(vdev)                    -\u003e video_device_release(vdev)    comp_register_videodev()     -\u003e video_device_release(mdev-\u003evdev)  Use video_device_release_empty() while registering the device so that registration failure paths do not free mdev-\u003evdev through vdev-\u003erelease(). comp_register_videodev() then releases mdev-\u003evdev exactly once on failure. Restore video_device_release() after successful registration so the registered device keeps its normal lifetime handling.  This issue was found by a static analysis tool I am developing.",
  "id": "DEBIAN-CVE-2026-72484",
  "modified": "2026-09-14T16:47:32.228501183Z",
  "published": "2026-08-15T06:22:22.647Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-72484"
    }
  ],
  "upstream": [
    "CVE-2026-72484"
  ]
}