CVE-2026-89874 media: v4l2-async: avoid deleting unlinked ASC entry on link error
A null pointer dereference in the Linux kernel's V4L2 async subsystem can cause a system crash when ancillary link creation fails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89874?
CVE-2026-89874 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-async: avoid deleting unlinked ASC entry on link error
v4l2_async_match_notify() creates ancillary media links before adding asc->asc_subdev_entry to sd->asc_list.
If ancillary link creation fails, the function jumps to err_call_unbind while asc_subdev_entry has not been linked yet. Async connections are zero-allocated, so the list entry still has NULL next and prev pointers on this path. Calling list_del() on it can therefore dereference NULL instead of returning the original link creation error.
Do not delete asc_subdev_entry from err_call_unbind. There is no list insertion to undo on this path; the bound callback and sub-device registration are the operations that need to be rolled back.
Which versions are affected by CVE-2026-89874?
How do I fix CVE-2026-89874?
Apply the vendor's patch.
Is CVE-2026-89874 being exploited?
There is no known exploitation of CVE-2026-89874 in the wild and no public exploit code.
Sources
Also known as AZL-101628, BELL-CVE-2026-89874, DEBIAN-CVE-2026-89874, GHSA-rmqv-gxqc-vfx4, UBUNTU-CVE-2026-89874.