CVE-2026-89874media: v4l2-async: avoid deleting unlinked ASC entry on link error
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: avoid deleting unlinked ASC entry on link error v4l2_async_match_notify() creates ancillary media links before adding asc->asc_subdev_entry to sd->asc_list. If ancillary link creation fails, the function jumps to err_call_unbind while asc_subdev_entry has not been linked yet. Async connections are zero-allocated, so the list entry still has NULL next and prev pointers on this path. Calling list_del() on it can therefore dereference NULL instead of returning the original link creation error. Do not delete asc_subdev_entry from err_call_unbind. There is no list insertion to undo on this path; the bound callback and sub-device registration are the operations that need to be rolled back.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 28a1295795d85a25f2e7dd391c43969e95fcb341 before d273571e531405426983c6a45ec635c7d0415eed; from 28a1295795d85a25f2e7dd391c43969e95fcb341 before caac13f518d83974e9884d1eeda3d4cc3bb92978; from 28a1295795d85a25f2e7dd391c43969e95fcb341 before 3345746e0957bce6c53644838e4955710a82a962; from 28a1295795d85a25f2e7dd391c43969e95fcb341 before a57d94026cb4fd7b3d258f0db2ad391cbccfaba5; from 28a1295795d85a25f2e7dd391c43969e95fcb341 before 47d82b605351c0e04f6365e42c8ffe2fcfdba615 | CNA record |
References
- https://git.kernel.org/stable/c/d273571e531405426983c6a45ec635c7d0415eed
- https://git.kernel.org/stable/c/caac13f518d83974e9884d1eeda3d4cc3bb92978
- https://git.kernel.org/stable/c/3345746e0957bce6c53644838e4955710a82a962
- https://git.kernel.org/stable/c/a57d94026cb4fd7b3d258f0db2ad391cbccfaba5
- https://git.kernel.org/stable/c/47d82b605351c0e04f6365e42c8ffe2fcfdba615
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.