CVE-2026-89871media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure kthread_run() returns an ERR_PTR on failure, not NULL. When start_streaming() fails, data->kthread_vid_cap is left holding this error pointer instead of being cleared. This causes two subsequent bugs: 1. A future call to start_streaming() sees a non-NULL kthread_vid_cap and returns 0 (success) immediately, without actually starting the capture thread. 2. A call to stop_streaming() checks 'kthread_vid_cap == NULL' which is false for an error pointer, and proceeds to call kthread_stop() on the error pointer, leading to a kernel crash. Fix this by resetting kthread_vid_cap to NULL on failure before jumping to the error path.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5cebaac609744414463d1ecc28fdecd26c1b9bc1 before db0f4531aa55cfb0171684ebfffe3ff04b79d5a8; 5cebaac609744414463d1ecc28fdecd26c1b9bc1 builds before 0fac63cac6689588da530764ccb6ba55ee8e4d8b; 5cebaac609744414463d1ecc28fdecd26c1b9bc1 builds before 5c35d380bea60503c4fe0986fe1de6a3263282b3; 5cebaac609744414463d1ecc28fdecd26c1b9bc1 builds before 3d1b10d81fe54852ed953f4129577b733bbd6907; from 5cebaac609744414463d1ecc28fdecd26c1b9bc1 before 968c5213e34c48d35febdfd09cf3dc58ad039140; from 5cebaac609744414463d1ecc28fdecd26c1b9bc1 before 52fd9d80c0cea7bf09e7ee36cad316e5c39b7fe6; 5cebaac609744414463d1ecc28fdecd26c1b9bc1 builds before 0e7f2cd72a4f9268ee09a13b13f3339e7cc71557; from 5cebaac609744414463d1ecc28fdecd26c1b9bc1 before 76e379754ba618989f6215be608d5c04774a611d | CNA record |
References
- https://git.kernel.org/stable/c/db0f4531aa55cfb0171684ebfffe3ff04b79d5a8
- https://git.kernel.org/stable/c/0fac63cac6689588da530764ccb6ba55ee8e4d8b
- https://git.kernel.org/stable/c/5c35d380bea60503c4fe0986fe1de6a3263282b3
- https://git.kernel.org/stable/c/3d1b10d81fe54852ed953f4129577b733bbd6907
- https://git.kernel.org/stable/c/968c5213e34c48d35febdfd09cf3dc58ad039140
- https://git.kernel.org/stable/c/52fd9d80c0cea7bf09e7ee36cad316e5c39b7fe6
- https://git.kernel.org/stable/c/0e7f2cd72a4f9268ee09a13b13f3339e7cc71557
- https://git.kernel.org/stable/c/76e379754ba618989f6215be608d5c04774a611d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.