CVE-2026-89901: Linux Kernel Airspy Use-After-Free Vulnerability

CVE-2026-89901 Overview

CVE-2026-89901 is a NULL pointer dereference vulnerability in the Linux kernel airspy media driver. The flaw occurs when a user closes a streaming file descriptor after the USB device has been disconnected. airspy_disconnect() clears s->udev under v4l2_lock, but airspy_stop_streaming() subsequently calls airspy_ctrl_msg() and airspy_free_stream_bufs() without checking whether s->udev is still valid. Both routines dereference the now-NULL USB device pointer, triggering a kernel oops. The fix replaces video_unregister_device() with vb2_video_unregister_device() so the vb2 queue is released synchronously while s->udev is still valid.

Critical Impact
Local users with access to the airspy Video4Linux (V4L2) device node can trigger a kernel NULL pointer dereference by closing the device after USB disconnect, resulting in denial of service.

Affected Products

Linux kernel airspy Software Defined Radio (SDR) media driver
Multiple stable kernel branches receiving the backported fix
Systems exposing /dev/swradio* device nodes to unprivileged users

Discovery Timeline

2026-09-16 - CVE-2026-89901 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89901

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in the drivers/media/usb/airspy driver. The driver registers a Video4Linux device backed by the videobuf2 (vb2) framework and uses vb2_fop_release() in its file_operations. On USB disconnect, airspy_disconnect() unregisters the video device and then sets s->udev = NULL under v4l2_lock. If a userspace process still holds an open file descriptor and is actively streaming, closing that descriptor invokes vb2_fop_release(), which in turn calls airspy_stop_streaming().

airspy_stop_streaming() unconditionally submits a control message via airspy_ctrl_msg(s, CMD_RECEIVER_MODE, 0, 0, NULL, 0) and then frees stream buffers through airspy_free_stream_bufs(). Both paths reach usb_sndctrlpipe(s->udev, 0) and usb_free_coherent(s->udev, ...), dereferencing the NULL s->udev and crashing the kernel.

Root Cause

The root cause is an ordering defect between device teardown and vb2 queue teardown. video_unregister_device() alone does not synchronously drain the vb2 queue, so stop_streaming() can run after s->udev has been cleared. The fix uses vb2_video_unregister_device() before clearing s->udev. That helper releases the vb2 queue and synchronously runs stop_streaming() while USB URBs, coherent DMA buffers, and hardware control messages still reference a valid udev. The redundant outer vb_queue_lock/v4l2_lock pair was removed to avoid a self-deadlock, since vb2_video_unregister_device() acquires vb_queue_lock internally.

Attack Vector

Exploitation requires local access to the airspy V4L2 character device and the ability to physically or logically disconnect the underlying USB device (for example, via authorized udev rules, usbip, or a hot-unplug event). An attacker with permission to open the device and initiate streaming can race the disconnect against a close of the file descriptor to force the kernel to dereference NULL, resulting in an oops and denial of service on the host. No code execution primitive is described in the upstream commit message. Refer to the Kernel Source Commit 2f378dc4 for the authoritative patch.

Detection Methods for CVE-2026-89901

Indicators of Compromise

Kernel oops or panic messages referencing airspy_stop_streaming, airspy_ctrl_msg, or airspy_free_stream_bufs in dmesg or /var/log/kern.log.
Stack traces showing NULL pointer dereference at usb_sndctrlpipe or usb_free_coherent originating from the airspy driver.
Unexpected disconnect events for airspy USB SDR devices immediately preceding a crash.

Detection Strategies

Monitor kernel ring buffers for BUG: kernel NULL pointer dereference entries whose call stacks include airspy symbols.
Correlate USB disconnect udev events with subsequent V4L2 device closures on /dev/swradio* nodes.
Track installed kernel versions across the fleet and flag hosts running airspy-enabled kernels that predate the referenced stable commits.

Monitoring Recommendations

Ingest dmesg and journald kernel logs into a centralized log platform and alert on oops signatures.
Inventory hosts loading the airspy module using lsmod telemetry and prioritize them for patching.
Alert on unexpected loading of media or SDR USB drivers on servers that should not host such hardware.

How to Mitigate CVE-2026-89901

Immediate Actions Required

Apply the stable kernel updates that include the airspy vb2_video_unregister_device() fix on all systems exposing the driver.
Restrict access to /dev/swradio* and related V4L2 device nodes to trusted users through group ownership and udev rules.
Unload the airspy module on systems that do not require SDR functionality using modprobe -r airspy and blacklist it.

Patch Information

The fix has been merged into the mainline kernel and backported across multiple stable branches. Reference commits include Kernel Source Commit 155d0378, Kernel Source Commit 297fee02, Kernel Source Commit 2f378dc4, Kernel Source Commit 6e4ea90f, Kernel Source Commit 75089cea, Kernel Source Commit a9a8c37d, Kernel Source Commit c6749ac8, and Kernel Source Commit c9081e26. Rebuild any custom kernels against a fixed source tree.

Workarounds

Blacklist the airspy kernel module on hosts that do not require SDR functionality.
Physically remove or disable USB access for airspy hardware on servers and shared systems.
Enforce strict permissions on V4L2 device nodes so that only vetted service accounts can open the streaming interface.

bash

# Disable the airspy driver on systems that do not need it
echo 'blacklist airspy' | sudo tee /etc/modprobe.d/blacklist-airspy.conf
sudo modprobe -r airspy 2>/dev/null || true
sudo update-initramfs -u