CVE-2026-89734: Linux Kernel USB Gadget Use-After-Free

CVE-2026-89734 Overview

CVE-2026-89734 is a null pointer dereference vulnerability in the Linux kernel's USB gadget UVC (USB Video Class) driver. The flaw resides in the uvcg_video_init() function within the usb: gadget: uvc subsystem. When kthread_run_worker() fails during initialization, the error handling path calls uvcg_err() using the video->uvc pointer, which has not yet been assigned. This dereference of an unassigned pointer causes a kernel-level fault.

The issue affects Linux kernel builds that include the UVC gadget driver, which is commonly used on embedded devices and systems that expose a USB video interface.

Critical Impact
A null pointer dereference in the UVC gadget initialization path can crash the kernel, resulting in a denial-of-service condition on affected systems.

Affected Products

Linux kernel versions containing the vulnerable uvcg_video_init() implementation in the USB gadget UVC driver
Systems using the USB gadget framework with UVC (USB Video Class) function enabled
Embedded Linux devices exposing USB video functionality via configfs-based gadgets

Discovery Timeline

2026-09-11 - CVE CVE-2026-89734 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89734

Vulnerability Analysis

The vulnerability is a null pointer dereference [CWE-476] in the Linux kernel USB gadget UVC driver. During execution of uvcg_video_init(), the driver calls kthread_run_worker() to spawn a kernel worker thread. If this call fails, control moves to an error branch that logs the failure through the uvcg_err() macro.

The uvcg_err() macro dereferences video->uvc to retrieve context for the log message. At this point in the initialization sequence, video->uvc has not yet been populated, so the dereference operates on an invalid pointer. The result is a kernel oops or panic on the failure path.

The fix replaces the reference to video->uvc with uvc->func, which is already assigned when the error handler runs. This preserves diagnostic logging without touching uninitialized state.

Root Cause

The root cause is incorrect ordering between logging and structure initialization. The error handling path assumed video->uvc was valid before the initialization sequence had assigned it. This is a classic case of using a field prior to its assignment inside a cleanup or failure branch.

Attack Vector

Triggering the fault requires reaching the failure path of kthread_run_worker() during UVC gadget initialization. This typically occurs under memory pressure or resource exhaustion conditions on a system that instantiates a UVC gadget. Because the code path lives in the gadget configuration flow, exploitation generally requires local privileges to configure USB gadgets through configfs, or a physical device configuration event. Impact is limited to denial of service through kernel crash.

The vulnerability mechanism is documented in the upstream commits. See the Linux Kernel Commit dbe2762 and related fixes for the exact change.

Detection Methods for CVE-2026-89734

Indicators of Compromise

Kernel oops or panic messages referencing uvcg_video_init or uvcg_err in dmesg or /var/log/kern.log
Sudden system reboots or kernel BUG traces coincident with USB gadget configuration activity
Failed UVC gadget bring-up events logged by configfs interactions under /sys/kernel/config/usb_gadget/

Detection Strategies

Inventory kernel versions across Linux endpoints and compare against the fixed commits published on git.kernel.org
Audit systems that load the usb_f_uvc module or configure UVC gadgets through configfs
Correlate kernel crash telemetry with USB gadget subsystem activity to identify affected hosts

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on stack traces containing uvcg_video_init
Monitor for unexpected kernel panics on embedded or IoT Linux devices that use USB video functionality
Track package and kernel update status across the fleet to confirm patched builds are deployed

How to Mitigate CVE-2026-89734

Immediate Actions Required

Identify Linux systems running kernels that include the UVC gadget driver and confirm exposure
Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor builds are available
On systems where UVC gadget functionality is not required, unload or disable the usb_f_uvc module

Patch Information

The fix has been merged into the Linux stable tree across the following commits: Linux Kernel Commit 5b1da38, Linux Kernel Commit d511e01, and Linux Kernel Commit dbe2762. Distribution maintainers will publish backports through their standard channels. Administrators should upgrade to a kernel package that incorporates these commits.

Workarounds

Avoid configuring UVC functions in USB gadget setups on unpatched kernels
Blacklist the usb_f_uvc module on systems that do not require USB video gadget functionality
Restrict access to configfs gadget configuration paths to trusted administrators only

bash

# Blacklist the UVC gadget function module on systems that do not need it
echo "blacklist usb_f_uvc" | sudo tee /etc/modprobe.d/blacklist-uvc-gadget.conf
sudo update-initramfs -u

# Verify installed kernel version
uname -r