CVE-2026-89874
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: avoid deleting unlinked ASC entry on link error v4l2_async_match_notify() creates ancillary media links before adding asc->asc_subdev_entry to sd->asc_list. If ancillary link creation fails, the function jumps to err_call_unbind while asc_subdev_entry has not been linked yet. Async connections are zero-allocated, so the list entry still has NULL next and prev pointers on this path. Calling list_del() on it can therefore dereference NULL instead of returning the original link creation error. Do not delete asc_subdev_entry from err_call_unbind. There is no list insertion to undo on this path; the bound callback and sub-device registration are the operations that need to be rolled back.
Affected versions
Linux kernel versions
6.6
and later are affected. Fixed in
6.6.157,
6.12.110,
6.18.51,
7.2.5,
7.3-rc1
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-89874?
CVE-2026-89874 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.6 onward and has been patched in 6.6.157, 6.12.110, 6.18.51 and others. CVE-2026-89874 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-89874?
Yes. CVE-2026-89874 has been patched. Fixed versions include 6.6.157, 6.12.110, 6.18.51 and others. If you are running Linux kernel 6.6 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-89874 actively exploited?
No. CVE-2026-89874 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.