CVE-2026-89888: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89888 Overview

CVE-2026-89888 is a use-after-free vulnerability in the Linux kernel's ov02a10 camera sensor driver (drivers/media/i2c/ov02a10.c). The flaw resides in the ov02a10_check_hwcfg() function, which releases an fwnode endpoint handle via fwnode_handle_put(ep) and then reuses the same freed handle in a subsequent fwnode_property_read_u32() call. A secondary bug causes the driver to overwrite the ret variable with the result of an optional property read, forcing probe failure when the property is absent. The issue affects Linux systems that load the OmniVision OV02A10 MIPI CSI camera driver during device probe.

Critical Impact
A local attacker with the ability to trigger the ov02a10 driver probe path can exploit the freed fwnode reference to achieve memory corruption in kernel context, enabling privilege escalation or denial of service.

Affected Products

Linux kernel builds including the ov02a10 media i2c driver prior to the fix commits
Stable kernel branches receiving the backports referenced in commits 213b248, 4c2988b, 6e13784, 8ddb3b6, 90f9b42, 94971ba, and 9de48ba
Distributions and embedded platforms shipping the OmniVision OV02A10 camera sensor support

Discovery Timeline

2026-09-16 - CVE-2026-89888 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89888

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the probe path of the ov02a10 camera sensor driver. Inside ov02a10_check_hwcfg(), the driver acquires an endpoint firmware node reference through fwnode_graph_get_next_endpoint() and parses it with v4l2_fwnode_endpoint_alloc_parse(). Immediately after parsing, the driver calls fwnode_handle_put(ep), releasing the reference. Later in the same function, the driver invokes fwnode_property_read_u32() against the already-released ep handle to read the optional ovti,mipi-clock-voltage property. Any access to the underlying object after the put may operate on freed or reallocated memory.

A second defect compounds the impact. The result of the optional property read is assigned to the local ret variable. When the property is absent, ret becomes negative and is returned at the end of the function, which incorrectly aborts driver probe even though the property is optional.

Root Cause

The root cause is incorrect object lifetime management. The endpoint handle is released before all consumers of that handle have completed their work. Additionally, error-code hygiene is broken because the return value of an optional operation clobbers a variable used to signal fatal probe failure.

Attack Vector

Exploitation requires local access with the ability to influence device tree or ACPI firmware node data consumed at driver probe. On systems where an attacker can trigger driver load, or where a physically present adversary can attach hardware that binds to the driver, the freed fwnode object can be reclaimed and controlled before it is read. Successful memory corruption in kernel context can be leveraged for privilege escalation, information disclosure, or a denial-of-service crash of the kernel.

No public proof-of-concept exploit is currently associated with CVE-2026-89888, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-89888

Indicators of Compromise

Unexpected kernel oops, KASAN use-after-free reports, or general protection faults referencing ov02a10_check_hwcfg, fwnode_property_read_u32, or fwnode_handle_put in dmesg.
Repeated failed probe attempts of the ov02a10 driver logged as -EINVAL or similar negative return codes on systems where the OV02A10 sensor is not present.
Unusual module load or rebind activity targeting the ov02a10 i2c driver from non-administrative contexts.

Detection Strategies

Enable CONFIG_KASAN on test and pre-production kernels to surface use-after-free access to freed fwnode handles during driver probe.
Compare running kernel versions and vendor backport metadata against the fix commits listed in the NVD advisory to identify unpatched hosts.
Monitor kernel ring buffer telemetry for stack traces that include the ov02a10 symbol namespace alongside memory-safety keywords.

Monitoring Recommendations

Forward dmesg and journald kernel logs to a centralized analytics pipeline and alert on crash signatures involving media i2c drivers.
Track driver bind/unbind events under /sys/bus/i2c/drivers/ov02a10/ to detect anomalous probe attempts.
Correlate kernel crash telemetry with user context and process ancestry to distinguish benign hardware discovery from suspicious probe triggering.

How to Mitigate CVE-2026-89888

Immediate Actions Required

Inventory Linux hosts that build the ov02a10 driver as a module or in-tree and prioritize patching devices exposing the OmniVision OV02A10 sensor.
Apply the vendor-provided kernel update that includes the upstream fix commits referenced in the NVD advisory.
Restrict local access on systems where the driver is loaded, particularly the ability to load kernel modules or attach untrusted hardware.

Patch Information

The fix moves the fwnode_property_read_u32() call to execute before fwnode_handle_put(ep), eliminating the use-after-free. The patch also stops assigning the property read return value to ret, preventing missing optional properties from failing probe. The change was backported across stable branches in the following commits: Kernel Git Commit 213b248, Kernel Git Commit 4c2988b, Kernel Git Commit 6e13784, Kernel Git Commit 8ddb3b6, Kernel Git Commit 90f9b42, Kernel Git Commit 94971ba, and Kernel Git Commit 9de48ba.

Workarounds

Blacklist the ov02a10 module on systems that do not require the OmniVision OV02A10 sensor to eliminate the vulnerable code path.
Restrict CAP_SYS_MODULE and require signed modules to prevent unprivileged loading of the affected driver.
Disable auto-binding of the ov02a10 driver in device tree overlays or ACPI tables on hosts that will not use the sensor.

bash

# Blacklist the ov02a10 driver until the kernel patch is deployed
echo "blacklist ov02a10" | sudo tee /etc/modprobe.d/blacklist-ov02a10.conf
sudo depmod -a
sudo modprobe -r ov02a10 2>/dev/null || true