« Volver al listado

CVE-2026-89892

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

media: em28xx: defer audio-only extension registration

The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before dev_next is created. The duplicate device inherits is_audio_only and is then independently inserted into em28xx_devlist.

The list is intended to contain only primary devices: extension operations reach the secondary device through dev_next. The independently linked secondary can be freed during disconnect while its list node remains reachable, resulting in a use-after-free.

Leer descripción completaMostrar menos

Defer audio-only extension registration to the module-request work item. It runs only after probing has completed construction of the optional secondary device, so only the primary is registered and extension callbacks reach the secondary through dev_next.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89892",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4a089668ef22c295ed4997289cc48446c849249c",
              "lessThan": "0da1e627f4fc9d0e947fdae90913042120878923",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4a089668ef22c295ed4997289cc48446c849249c",
              "lessThan": "f8d7e77d9c621b42a191c67a9b37bec23dc1d555",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4a089668ef22c295ed4997289cc48446c849249c",
              "lessThan": "1abe9524dec0fd26e9ceb8d586034d6f68dd8273",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4a089668ef22c295ed4997289cc48446c849249c",
              "lessThan": "4e11c45dfdc72ab656067b1df8fcebaf52fd4715",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4a089668ef22c295ed4997289cc48446c849249c",
              "lessThan": "d06067ee32620f272cfb80c7bc7c572ad4e74724",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4a089668ef22c295ed4997289cc48446c849249c",
              "lessThan": "f9322ac9f862961d7f377b87ec26c8565af7e073",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4a089668ef22c295ed4997289cc48446c849249c",
              "lessThan": "4666197ca4f7d80cd3b0292054fe45d76be9ba04",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4a089668ef22c295ed4997289cc48446c849249c",
              "lessThan": "95f76f51937fdfb0fc1e14cae606b1ef574a56f3",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/media/usb/em28xx/em28xx-cards.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/media/usb/em28xx/em28xx-cards.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-16T11:16:57.870",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0da1e627f4fc9d0e947fdae90913042120878923",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1abe9524dec0fd26e9ceb8d586034d6f68dd8273",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4666197ca4f7d80cd3b0292054fe45d76be9ba04",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4e11c45dfdc72ab656067b1df8fcebaf52fd4715",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/95f76f51937fdfb0fc1e14cae606b1ef574a56f3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d06067ee32620f272cfb80c7bc7c572ad4e74724",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f8d7e77d9c621b42a191c67a9b37bec23dc1d555",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f9322ac9f862961d7f377b87ec26c8565af7e073",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: em28xx: defer audio-only extension registration\n\nThe audio-only path registers extensions while probing the primary device.\nFor a dual-TS board, this happens before dev_next is created. The duplicate\ndevice inherits is_audio_only and is then independently inserted into\nem28xx_devlist.\n\nThe list is intended to contain only primary devices: extension operations\nreach the secondary device through dev_next. The independently linked\nsecondary can be freed during disconnect while its list node remains\nreachable, resulting in a use-after-free.\n\nDefer audio-only extension registration to the module-request work item. It\nruns only after probing has completed construction of the optional\nsecondary device, so only the primary is registered and extension callbacks\nreach the secondary through dev_next."
    }
  ],
  "lastModified": "2026-09-16T11:16:57.870",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}