CVE-2026-89871 Overview
CVE-2026-89871 is a Linux kernel vulnerability in the video-i2c media driver. The flaw stems from improper error handling when kthread_run() fails during start_streaming(). The function returns an ERR_PTR on failure rather than NULL, and the driver stored this error pointer in data->kthread_vid_cap instead of clearing it. Subsequent operations on the driver interpret the error pointer as a valid kthread reference, producing incorrect control flow and a kernel crash when kthread_stop() is called on the invalid pointer.
Critical Impact
A local user able to trigger repeated streaming failures on a video-i2c device can crash the kernel through a null pointer dereference on an invalid ERR_PTR value.
Affected Products
- Linux kernel media/video-i2c driver (upstream stable branches)
- Distributions shipping affected stable kernel versions prior to backport
- Systems with video-i2c hardware exposed to unprivileged or containerized workloads
Discovery Timeline
- 2026-09-16 - CVE-2026-89871 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89871
Vulnerability Analysis
The defect resides in the video-i2c driver's streaming lifecycle. When start_streaming() invokes kthread_run() and the call fails, the kernel returns a value wrapped by ERR_PTR(). The driver stored this value in data->kthread_vid_cap and jumped to the error path without clearing the field. As a result, the field no longer indicated the absence of a running kthread.
Two follow-on bugs emerge from this state. First, a subsequent start_streaming() call observes a non-NULLkthread_vid_cap and returns success without launching a capture thread, silently breaking capture functionality. Second, stop_streaming() compares the field to NULL, which is false for an error pointer, and then calls kthread_stop() on the invalid pointer. The kernel dereferences the encoded error value and crashes.
Root Cause
The root cause is improper input validation of the return value from kthread_run(). The driver treated only NULL as failure, missing the IS_ERR() case. This is a classic Linux kernel API misuse where an ERR_PTR value is leaked into pointer-typed state. The fix resets data->kthread_vid_cap to NULL on failure before branching to the error label.
Attack Vector
Exploitation requires local access to a system exposing a video-i2c device node, typically /dev/videoX, with permissions that allow the attacker to open the device and issue streaming ioctls. By forcing start_streaming() failure conditions and then invoking stop_streaming(), an attacker triggers a kernel dereference of the error pointer, resulting in denial of service. The vulnerability does not have a public exploit, and remote exploitation is not documented.
Refer to the upstream fix in the Linux Kernel Commit for the precise code change.
Detection Methods for CVE-2026-89871
Indicators of Compromise
- Kernel oops or panic messages referencing kthread_stop with a fault address matching an ERR_PTR encoding (small negative values such as 0xfffffffffffffff4).
- Repeated VIDIOC_STREAMON failures on video-i2c device nodes followed by a VIDIOC_STREAMOFF call from the same process.
- Loss of capture functionality on video-i2c devices with no error returned to userspace.
Detection Strategies
- Audit installed kernel packages against the fixed stable versions referenced in the upstream commits listed under External References.
- Monitor dmesg and journalctl -k for kernel warnings originating in drivers/media/i2c/video-i2c.c.
- Enable kernel panic_on_oops in test environments to surface latent triggers during regression testing.
Monitoring Recommendations
- Ingest kernel logs into a centralized log platform and alert on BUG:, Oops:, or general protection fault events referencing video-i2c or kthread_stop.
- Track process invocations of V4L2 ioctls against /dev/video* from non-media workloads or containers as anomalous behavior.
- Correlate host stability events with the presence of vulnerable kernel builds identified via package inventory.
How to Mitigate CVE-2026-89871
Immediate Actions Required
- Inventory all Linux hosts running kernels that include the video-i2c driver and identify systems that expose /dev/video* nodes to untrusted users or containers.
- Apply the vendor-supplied stable kernel update that includes the upstream fix, then reboot affected systems.
- Restrict access to video-i2c device nodes to trusted users where patching cannot be performed immediately.
Patch Information
The fix resets data->kthread_vid_cap to NULL on failure before jumping to the error path in start_streaming(). The change has been merged and backported across multiple stable branches. See the upstream commits: 0e7f2cd7, 0fac63ca, 3d1b10d8, 52fd9d80, 5c35d380, 76e37975, 968c5213, and db0f4531.
Workarounds
- Blacklist the video-i2c module on systems that do not require it using /etc/modprobe.d/ configuration.
- Tighten permissions on /dev/video* device nodes so only trusted service accounts can open them.
- Prevent unprivileged container runtimes from passing through V4L2 devices until the host kernel is patched.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
