CVE-2026-89734 usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
A null pointer dereference in the Linux kernel USB gadget driver can cause a system crash when specific initialization errors occur.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89734?
CVE-2026-89734 is a vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
In uvcg_video_init(), if kthread_run_worker() fails, the error logged uses uvcg_err(), however, the pointer it uses: video->uvc is not assigned at this point, triggering a null pointer dereference. Fix this by directly using uvc->func which is assigned already.
Which versions are affected by CVE-2026-89734?
How do I fix CVE-2026-89734?
Apply the vendor's patch.
Is CVE-2026-89734 being exploited?
There is no known exploitation of CVE-2026-89734 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-89734, DEBIAN-CVE-2026-89734, GHSA-v583-q5v7-76fp, UBUNTU-CVE-2026-89734.