CVE-2026-89892: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89892 Overview

CVE-2026-89892 is a use-after-free vulnerability in the Linux kernel em28xx media driver. The flaw resides in the audio-only device probing path for Empia em28xx-based USB video capture devices. On dual-TS boards, the audio-only path registers extensions before the secondary device (dev_next) is created. The duplicate device inherits the is_audio_only flag and is independently inserted into em28xx_devlist. Because the list is intended to contain only primary devices, the secondary device can be freed during disconnect while its list node remains reachable, resulting in a use-after-free condition.

Critical Impact
A use-after-free in the em28xx driver can lead to kernel memory corruption, denial of service, or potential local privilege escalation triggered by USB device disconnect events.

Affected Products

Linux kernel em28xx media driver (drivers/media/usb/em28xx)
Systems using Empia em28xx-based dual-TS USB capture devices
Multiple stable Linux kernel branches referenced in the fix commits

Discovery Timeline

2026-09-16 - CVE-2026-89892 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89892

Vulnerability Analysis

The em28xx driver supports USB TV capture devices, including dual transport stream (dual-TS) boards that expose a primary and secondary device instance. The audio-only probing path calls extension registration before the primary device finishes constructing its optional secondary device (dev_next).

When extensions run during audio-only probe, the duplicate device inherits the is_audio_only attribute. That duplicate is then inserted independently into the global em28xx_devlist. The design contract for em28xx_devlist is that it holds only primary devices; extension callbacks reach the secondary device by walking dev_next from the primary.

Violating this invariant means the secondary device now has two independent references: one from the list and one from dev_next. On disconnect, the secondary object can be freed through one reference while the list node remains reachable through the other, producing a classic use-after-free [CWE-416].

Root Cause

The root cause is an ordering violation in device registration. Audio-only extension registration executes before the probe function finalizes construction of the paired secondary device. This produces a state where the secondary device is inserted into em28xx_devlist as if it were a standalone primary, breaking the list ownership model that extension teardown and disconnect logic rely on.

Attack Vector

Triggering the flaw requires the presence of an em28xx dual-TS capture device on the affected system, followed by a probe and disconnect sequence. An attacker with physical access to a USB port or the ability to induce hotplug events could reach the vulnerable code path. Kernel memory reachable after free may be reallocated before subsequent access, creating conditions for corruption or controlled writes.

The fix defers audio-only extension registration to the module-request work item. The work item runs only after probing has completed construction of the optional secondary device, ensuring only the primary is registered and that extension callbacks correctly traverse dev_next to reach the secondary.

// Vulnerability described in prose only - no verified exploit code available.
// See kernel commits referenced below for the exact source-level fix.

Detection Methods for CVE-2026-89892

Indicators of Compromise

Kernel oops or panic messages referencing em28xx, em28xx_close_extension, or em28xx_devlist traversal
KASAN reports flagging use-after-free in drivers/media/usb/em28xx during USB disconnect
Unexpected crashes correlated with hotplug of USB TV tuner or capture hardware

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface use-after-free access in the em28xx path
Review kernel ring buffer (dmesg) for stack traces involving em28xx_close_extension or em28xx_v4l2_close during device disconnect
Inventory hosts loading the em28xx module using package management and lsmod telemetry to scope exposure

Monitoring Recommendations

Forward journald and dmesg kernel events to a central log platform and alert on em28xx warnings, oopses, or KASAN reports
Monitor USB device connect and disconnect events (udev) on systems where the em28xx module is loaded
Track kernel package versions across the fleet to identify hosts still running pre-patch builds

How to Mitigate CVE-2026-89892

Immediate Actions Required

Update the Linux kernel to a version that includes the fix commits listed in the NVD references for CVE-2026-89892
If patching is not immediately possible, unload the em28xx module on systems that do not require USB TV capture functionality
Restrict physical access to USB ports on affected hosts to limit trigger opportunities

Patch Information

The fix defers audio-only extension registration to the module-request work item so the secondary device is not registered independently. The patch has been merged across multiple stable branches. Relevant commits include 0da1e627f4fc, 1abe9524dec0, 4666197ca4f7, 4e11c45dfdc7, 95f76f51937f, d06067ee3262, f8d7e77d9c62, and f9322ac9f862. See the Linux Kernel Commit 0da1e62 and companion commits for the complete change set.

Workarounds

Blacklist the em28xx module in /etc/modprobe.d/ on systems that do not use Empia em28xx capture hardware
Disable USB autosuspend and hotplug for untrusted ports on servers that must retain the module
Physically disconnect and disallow reconnection of dual-TS em28xx devices until the kernel is patched

bash

# Blacklist the em28xx module until the kernel is patched
echo "blacklist em28xx" | sudo tee /etc/modprobe.d/blacklist-em28xx.conf
sudo depmod -a
sudo rmmod em28xx 2>/dev/null || true