CVE-2026-89891: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89891 Overview

CVE-2026-89891 is a use-after-free vulnerability in the Linux kernel's em28xx media driver. The flaw affects USB devices with has_dual_ts=1 that traverse the is_audio_only code path. During probe, both dev and dev->dev_next are added to the global em28xx_devlist via em28xx_init_extension(). On disconnect, only dev is removed, leaving dev->dev_next->devlist linked to the freed structure. Subsequent probes that call em28xx_init_extension() trigger list corruption when list_add_tail walks the dangling pointer. The bug became reachable after commit a368ecde8a50 normalized reserved bits in USB endpoint descriptors, allowing fuzzed endpoint addresses to be interpreted as vendor audio endpoints.

Critical Impact
Kernel list corruption from a use-after-free on the global em28xx_devlist, reachable through a crafted or fuzzed USB device descriptor.

Affected Products

Linux kernel em28xx media driver (upstream)
Distributions shipping kernels containing commit a368ecde8a50 ("USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor")
Systems that autoload the em28xx driver on USB device insertion

Discovery Timeline

2026-09-16 - CVE-2026-89891 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89891

Vulnerability Analysis

The em28xx driver supports Empia-based USB video/audio capture devices. Devices marked has_dual_ts=1 allocate a secondary device structure, dev->dev_next, to represent a second transport stream. When the probe path detects is_audio_only, both structures are registered with the extension subsystem, which links each struct em28xx into the global em28xx_devlist linked list.

The defect lives in em28xx_close_extension(). The routine unlinks only the primary dev via list_del(&dev->devlist). It never touches dev->dev_next->devlist. When dev_next is later released by kref_put(), the memory backing its list_head is freed while it remains reachable from the global list. The next USB probe calling em28xx_init_extension() uses list_add_tail, which follows the poisoned prev/next pointers of the freed node and triggers a kernel list corruption BUG.

Root Cause

The root cause is asymmetric list management: em28xx_init_extension() inserts two nodes, but em28xx_close_extension() removes only one. This use-after-free [CWE-416] on the freed dev_next->devlist pointer corrupts a global kernel linked list on the next device insertion.

Attack Vector

An attacker with physical access, or the ability to inject USB descriptors through virtualized or emulated USB (for example, USB-over-IP or a malicious peripheral), can present a device whose bEndpointAddress normalizes to 0x83 after reserved-bit clearing introduced by commit a368ecde8a50. The driver treats this as a vendor audio endpoint, enabling the is_audio_only + has_dual_ts path. Repeated connect/disconnect cycles then trigger the corruption. Exploitation requires local proximity or virtual USB access rather than network reachability.

The fix removes dev->dev_next->devlist from the global list inside em28xx_close_extension() before the secondary device is freed, restoring symmetric list bookkeeping. See the upstream commits linked under references for the exact patch hunks, including Linux Kernel Commit 0782807 and Linux Kernel Commit 16cb1ee.

Detection Methods for CVE-2026-89891

Indicators of Compromise

Kernel log entries containing list_add corruption or list_del corruption referencing em28xx_devlist.
Oops or BUG traces originating in em28xx_init_extension or em28xx_close_extension.
Unexpected USB device insertions presenting em28xx-compatible IDs on systems that do not use video capture hardware.

Detection Strategies

Monitor dmesg and /var/log/kern.log for list corruption warnings tied to the em28xx module.
Track modprobe and udev events that load em28xx in response to newly attached USB devices.
Alert on kernel panics or task hangs correlated with USB hotplug activity on servers and workstations.

Monitoring Recommendations

Collect kernel ring buffer output centrally and parse for em28xx and list_ corruption strings.
Baseline expected USB device classes per host and flag unauthorized media capture devices.
Enable KASAN on test kernels to catch use-after-free access to em28xx_devlist during QA.

How to Mitigate CVE-2026-89891

Immediate Actions Required

Apply the upstream stable-tree patches referenced below to affected kernel branches and rebuild.
Blocklist the em28xx module on hosts that do not require USB TV or capture support.
Restrict physical and virtual USB access on servers, kiosks, and shared workstations.

Patch Information

The vulnerability is fixed by upstream commits distributed across stable branches. Apply the change that removes dev->dev_next->devlist from em28xx_devlist inside em28xx_close_extension(). Relevant commits include Linux Kernel Commit 1ed575b, Linux Kernel Commit 20aacd8, Linux Kernel Commit 20c2c65, Linux Kernel Commit 826915b, Linux Kernel Commit da4b07d, and Linux Kernel Commit f617203. Track your distribution's kernel security advisory for backports.

Workarounds

Add blacklist em28xx to /etc/modprobe.d/em28xx-blacklist.conf on systems that do not need the driver.
Enforce USB device authorization by setting /sys/bus/usb/devices/usbX/authorized_default to 0 and allowlisting required devices.
Deploy USBGuard policies to restrict which USB classes and vendor IDs can bind on production hosts.

bash

# Configuration example
echo 'blacklist em28xx' | sudo tee /etc/modprobe.d/em28xx-blacklist.conf
sudo rmmod em28xx 2>/dev/null || true
sudo update-initramfs -u