« Volver al listado

CVE-2026-89871

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure

kthread_run() returns an ERR_PTR on failure, not NULL. When start_streaming() fails, data->kthread_vid_cap is left holding this error pointer instead of being cleared.

Fix this by resetting kthread_vid_cap to NULL on failure before jumping to the error path.

Detalles técnicos trazas, registros y código del informe original
This causes two subsequent bugs:
1. A future call to start_streaming() sees a non-NULL kthread_vid_cap
   and returns 0 (success) immediately, without actually starting the
   capture thread.
2. A call to stop_streaming() checks 'kthread_vid_cap == NULL' which
   is false for an error pointer, and proceeds to call kthread_stop()
   on the error pointer, leading to a kernel crash.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89871",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5cebaac609744414463d1ecc28fdecd26c1b9bc1",
              "lessThan": "db0f4531aa55cfb0171684ebfffe3ff04b79d5a8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5cebaac609744414463d1ecc28fdecd26c1b9bc1",
              "lessThan": "0fac63cac6689588da530764ccb6ba55ee8e4d8b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5cebaac609744414463d1ecc28fdecd26c1b9bc1",
              "lessThan": "5c35d380bea60503c4fe0986fe1de6a3263282b3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5cebaac609744414463d1ecc28fdecd26c1b9bc1",
              "lessThan": "3d1b10d81fe54852ed953f4129577b733bbd6907",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5cebaac609744414463d1ecc28fdecd26c1b9bc1",
              "lessThan": "968c5213e34c48d35febdfd09cf3dc58ad039140",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5cebaac609744414463d1ecc28fdecd26c1b9bc1",
              "lessThan": "52fd9d80c0cea7bf09e7ee36cad316e5c39b7fe6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5cebaac609744414463d1ecc28fdecd26c1b9bc1",
              "lessThan": "0e7f2cd72a4f9268ee09a13b13f3339e7cc71557",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5cebaac609744414463d1ecc28fdecd26c1b9bc1",
              "lessThan": "76e379754ba618989f6215be608d5c04774a611d",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/media/i2c/video-i2c.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/media/i2c/video-i2c.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-16T11:16:55.287",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0e7f2cd72a4f9268ee09a13b13f3339e7cc71557",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/0fac63cac6689588da530764ccb6ba55ee8e4d8b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3d1b10d81fe54852ed953f4129577b733bbd6907",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/52fd9d80c0cea7bf09e7ee36cad316e5c39b7fe6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5c35d380bea60503c4fe0986fe1de6a3263282b3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/76e379754ba618989f6215be608d5c04774a611d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/968c5213e34c48d35febdfd09cf3dc58ad039140",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/db0f4531aa55cfb0171684ebfffe3ff04b79d5a8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure\n\nkthread_run() returns an ERR_PTR on failure, not NULL.\nWhen start_streaming() fails, data->kthread_vid_cap is left holding\nthis error pointer instead of being cleared.\n\nThis causes two subsequent bugs:\n1. A future call to start_streaming() sees a non-NULL kthread_vid_cap\n   and returns 0 (success) immediately, without actually starting the\n   capture thread.\n2. A call to stop_streaming() checks 'kthread_vid_cap == NULL' which\n   is false for an error pointer, and proceeds to call kthread_stop()\n   on the error pointer, leading to a kernel crash.\n\nFix this by resetting kthread_vid_cap to NULL on failure before\njumping to the error path."
    }
  ],
  "lastModified": "2026-09-16T11:16:55.287",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}