« Volver al listado

CVE-2026-89874

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-async: avoid deleting unlinked ASC entry on link error

v4l2_async_match_notify() creates ancillary media links before adding asc->asc_subdev_entry to sd->asc_list.

If ancillary link creation fails, the function jumps to err_call_unbind while asc_subdev_entry has not been linked yet. Async connections are zero-allocated, so the list entry still has NULL next and prev pointers on this path. Calling list_del() on it can therefore dereference NULL instead of returning the original link creation error.

Do not delete asc_subdev_entry from err_call_unbind. There is no list insertion to undo on this path; the bound callback and sub-device registration are the operations that need to be rolled back.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89874",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "28a1295795d85a25f2e7dd391c43969e95fcb341",
              "lessThan": "d273571e531405426983c6a45ec635c7d0415eed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "28a1295795d85a25f2e7dd391c43969e95fcb341",
              "lessThan": "caac13f518d83974e9884d1eeda3d4cc3bb92978",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "28a1295795d85a25f2e7dd391c43969e95fcb341",
              "lessThan": "3345746e0957bce6c53644838e4955710a82a962",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "28a1295795d85a25f2e7dd391c43969e95fcb341",
              "lessThan": "a57d94026cb4fd7b3d258f0db2ad391cbccfaba5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "28a1295795d85a25f2e7dd391c43969e95fcb341",
              "lessThan": "47d82b605351c0e04f6365e42c8ffe2fcfdba615",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/media/v4l2-core/v4l2-async.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/media/v4l2-core/v4l2-async.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-16T11:16:55.643",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3345746e0957bce6c53644838e4955710a82a962",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/47d82b605351c0e04f6365e42c8ffe2fcfdba615",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a57d94026cb4fd7b3d258f0db2ad391cbccfaba5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/caac13f518d83974e9884d1eeda3d4cc3bb92978",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d273571e531405426983c6a45ec635c7d0415eed",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-async: avoid deleting unlinked ASC entry on link error\n\nv4l2_async_match_notify() creates ancillary media links before adding\nasc->asc_subdev_entry to sd->asc_list.\n\nIf ancillary link creation fails, the function jumps to\nerr_call_unbind while asc_subdev_entry has not been linked yet. Async\nconnections are zero-allocated, so the list entry still has NULL next\nand prev pointers on this path. Calling list_del() on it can therefore\ndereference NULL instead of returning the original link creation error.\n\nDo not delete asc_subdev_entry from err_call_unbind. There is no list\ninsertion to undo on this path; the bound callback and sub-device\nregistration are the operations that need to be rolled back."
    }
  ],
  "lastModified": "2026-09-16T11:16:55.643",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}