Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-89874

media: v4l2-async: avoid deleting unlinked ASC entry on link error

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: avoid deleting unlinked ASC entry on link error v4l2_async_match_notify() creates ancillary media links before adding asc->asc_subdev_entry to sd->asc_list. If ancillary link creation fails, the function jumps to err_call_unbind while asc_subdev_entry has not been linked yet. Async connections are zero-allocated, so the list entry still has NULL next and prev pointers on this path. Calling list_del() on it can therefore dereference NULL instead of returning the original link creation error. Do not delete asc_subdev_entry from err_call_unbind. There is no list insertion to undo on this path; the bound callback and sub-device registration are the operations that need to be rolled back.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 28a1295795d85a25f2e7dd391c43969e95fcb341 to < d273571e531405426983c6a45ec635c7d0415eedaffected
  • 28a1295795d85a25f2e7dd391c43969e95fcb341 to < caac13f518d83974e9884d1eeda3d4cc3bb92978affected
  • 28a1295795d85a25f2e7dd391c43969e95fcb341 to < 3345746e0957bce6c53644838e4955710a82a962affected
  • 28a1295795d85a25f2e7dd391c43969e95fcb341 to < a57d94026cb4fd7b3d258f0db2ad391cbccfaba5affected
  • 28a1295795d85a25f2e7dd391c43969e95fcb341 to < 47d82b605351c0e04f6365e42c8ffe2fcfdba615affected

Linux Linux

Default version status: affected

  • 6.6affected
  • 0 to < 6.6unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.51 to ≤ 6.18.*unaffected
  • 7.2.5 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References