CVE-2026-89872: Linux Kernel Information Disclosure Vulnerability

CVE-2026-89872 Overview

CVE-2026-89872 is a resource management flaw in the Linux kernel's Video4Linux2 (V4L2) media subsystem. The v4l2_fwnode_parse_link() function acquires a remote endpoint firmware node (fwnode) reference through fwnode_graph_get_remote_endpoint(). While error paths correctly release this reference, the success path returns without calling fwnode_handle_put(). Each successful parse operation leaks a reference count, gradually exhausting kernel resources associated with the firmware node graph.

The patch adds the missing fwnode_handle_put() call before the success return to balance the reference count.

Critical Impact
Repeated invocation of the affected code path leaks kernel firmware node references, which can lead to resource exhaustion and impact long-running systems using V4L2 media devices.

Affected Products

Linux kernel media subsystem (drivers/media/v4l2-core/v4l2-fwnode.c)
Linux stable branches receiving backports referenced in the kernel git commits
Systems using V4L2 fwnode-based media device topologies

Discovery Timeline

2026-09-16 - CVE-2026-89872 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89872

Vulnerability Analysis

The Linux kernel's V4L2 fwnode helpers parse media device link topology described in firmware (for example, ACPI or Device Tree). v4l2_fwnode_parse_link() walks the endpoint graph and, for each local endpoint, resolves the corresponding remote endpoint by calling fwnode_graph_get_remote_endpoint().

This lookup returns a reference-counted fwnode_handle. The reference must be released with fwnode_handle_put() once the caller finishes using it. In the vulnerable code, that release only occurs in error branches. When parsing succeeds and the function returns 0, the acquired reference is never dropped.

Each successful call therefore increments the fwnode reference count without a matching decrement. The leak accumulates over device probing, hot-plug events, or repeated media graph enumeration.

Root Cause

The root cause is an unbalanced reference count on a fwnode handle acquired inside v4l2_fwnode_parse_link(). The function correctly releases the reference on failure but omits the fwnode_handle_put() call on the success path, producing a classic memory leak pattern on a reference-counted kernel object.

Attack Vector

Exploitation requires local interaction with the media subsystem. An attacker with the ability to trigger repeated parsing of V4L2 firmware link descriptors, for example by rebinding drivers or repeatedly probing devices, can amplify the leak. The vulnerability does not directly enable code execution or privilege escalation, but it degrades kernel resource availability over time on systems where the affected path is reachable.

Because the flaw is a reference leak rather than a memory corruption issue, no exploitation code is applicable. Refer to the upstream kernel commits for the exact patch diff.

Detection Methods for CVE-2026-89872

Indicators of Compromise

Gradual increase in kernel memory or fwnode-related slab allocations on systems using V4L2 media devices
Warnings related to firmware node reference imbalance during driver unbind or module removal
Media device driver probes failing over time on long-uptime systems that repeatedly parse link topology

Detection Strategies

Compare the running kernel version and media subsystem source against the fixed commits listed in the kernel.org stable tree to confirm whether the patch is present.
Audit distribution kernel changelogs for backports of the v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link commit.
Monitor kernel logs (dmesg) for unusual media subsystem warnings after driver bind/unbind cycles.

Monitoring Recommendations

Track slab and kmalloc counters on systems with active V4L2 devices to identify slow, monotonic growth correlated with media activity.
Include kernel package versions and applied patches in configuration management inventory to flag hosts running unpatched versions.
Alert on repeated driver probe or media graph enumeration events on production hosts that should have static device topology.

How to Mitigate CVE-2026-89872

Immediate Actions Required

Update the Linux kernel to a version that includes the upstream fix from the referenced stable commits.
Prioritize systems that expose V4L2 devices with complex link topologies, such as multi-sensor camera platforms and industrial imaging hosts.
Reboot affected systems after patching to clear any accumulated leaked references.

Patch Information

The fix adds the missing fwnode_handle_put() call on the success path of v4l2_fwnode_parse_link(). Patches are available across multiple stable branches. See:

Workarounds

Restrict access to workflows that repeatedly trigger V4L2 media graph parsing, such as automated driver rebind loops, until the patch is applied.
Schedule periodic reboots for long-uptime systems running unpatched kernels that use V4L2 media devices.
Where feasible, avoid loading V4L2 fwnode-based drivers on systems that do not require them.

bash

# Verify running kernel version and check for the applied fix
uname -r
grep -R "fwnode_handle_put" /usr/src/linux/drivers/media/v4l2-core/v4l2-fwnode.c