CVE-2026-89874: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89874 Overview

CVE-2026-89874 is a NULL pointer dereference vulnerability in the Linux kernel's Video4Linux2 (V4L2) asynchronous subdevice framework. The flaw exists in v4l2_async_match_notify() within the media subsystem. When ancillary media link creation fails, the error path calls list_del() on an asc_subdev_entry that was never inserted into the list. Because async connections are zero-allocated, the entry's next and prev pointers remain NULL, causing a kernel-mode NULL pointer dereference instead of returning the original link creation error.

Critical Impact
A failure during ancillary link creation triggers a NULL pointer dereference in kernel space, leading to a kernel oops or system crash when V4L2 subdevice registration fails.

Affected Products

Linux kernel media subsystem (drivers/media/v4l2-core/v4l2-async.c)
Multiple stable Linux kernel branches receiving backported fixes
Systems using V4L2 async subdevice registration with ancillary media links

Discovery Timeline

2026-09-16 - CVE-2026-89874 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89874

Vulnerability Analysis

The vulnerability resides in the v4l2_async_match_notify() function in the Linux kernel media subsystem. This function is responsible for notifying that an async subdevice has been matched, binding it to a notifier, and creating ancillary media links between subdevices. The correct ordering of operations matters because rollback logic on error paths assumes prior state.

The function creates ancillary media links before adding asc->asc_subdev_entry to the sd->asc_list linked list. If ancillary link creation fails, control jumps to the err_call_unbind label. At that point, asc_subdev_entry has not yet been inserted into any list. Because async connection structures are zero-allocated, the list head's next and prev pointers remain NULL.

The cleanup path then invokes list_del() on this uninitialized list entry. The list_del() implementation dereferences both pointers to unlink the node, producing a NULL pointer dereference in kernel context. This masks the original error and destabilizes the kernel.

Root Cause

The root cause is improper error-path handling. The err_call_unbind label executes cleanup steps that assume the list insertion has already occurred. It attempts to reverse an operation that never happened, treating an uninitialized list_head as a linked node.

Attack Vector

Triggering the flaw requires the kernel to enter the failing branch during V4L2 async subdevice registration. This typically occurs during media device probe or hotplug of camera and video hardware when ancillary link creation fails. The scenario is generally local and tied to driver initialization rather than remote input, but it can result in denial of service through a kernel crash.

See the upstream fix commits for exact patch content, including 3345746e, 47d82b60, a57d9402, caac13f5, and d273571e.

Detection Methods for CVE-2026-89874

Indicators of Compromise

Kernel oops or panic messages referencing v4l2_async_match_notify or list_del in the call stack.
dmesg entries showing NULL pointer dereference during media or camera subdevice probe.
Unexpected reboots or hangs correlated with loading V4L2 drivers or hotplugging camera hardware.

Detection Strategies

Inventory Linux hosts and identify running kernel versions relative to the fixed stable branches listed in the upstream patches.
Review kernel logs across fleets for BUG: messages tied to the V4L2 async code path.
Correlate media subsystem driver load failures with subsequent kernel instability.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized logging pipeline for pattern matching on kernel oops signatures.
Alert on repeated NULL pointer dereference events in kernel telemetry, especially on systems with attached camera or media hardware.
Track kernel package versions across the environment to confirm patched builds are deployed.

How to Mitigate CVE-2026-89874

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the stable commit hashes to all affected kernel branches.
Update distribution kernels once vendor-provided packages incorporating the fix become available.
Reboot affected hosts after patching to load the corrected kernel image.

Patch Information

The fix removes the erroneous list_del() call from the err_call_unbind path in v4l2_async_match_notify(). No list insertion has occurred at that point, so there is nothing to remove. The bound callback and sub-device registration remain the only operations that require rollback. Merged fixes are available at 3345746e, 47d82b60, a57d9402, caac13f5, and d273571e.

Workarounds

Where patching is not immediately possible, avoid loading V4L2 async subdevice drivers that can trigger ancillary link creation failures.
Restrict local access on multi-user systems to reduce the chance of triggering failing probe conditions through hardware attachment.
Blacklist affected media drivers on hosts that do not require camera or video capture functionality until a patched kernel is deployed.

bash

# Verify running kernel version and check for patched build
uname -r

# Example: prevent loading of a specific V4L2 driver module until patched
echo "blacklist <module_name>" | sudo tee /etc/modprobe.d/blacklist-v4l2.conf
sudo update-initramfs -u