CVE-2026-89888 media: i2c: ov02a10: fix endpoint parsing use-after-free
A use-after-free vulnerability in the Linux kernel's ov02a10 camera driver allows attackers to cause denial of service or potentially execute code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89888?
CVE-2026-89888 is a high-severity use after free vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: i2c: ov02a10: fix endpoint parsing use-after-free
The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint. However, it subsequently calls fwnode_property_read_u32() using the same 'ep' handle, leading to a potential use-after-free.
Additionally, reading the optional 'ovti,mipi-clock-voltage' property used to overwrite the 'ret' variable. If the property was missing, 'ret' would become negative, and this failure code would be incorrectly returned at the end of the function, causing probe to fail entirely.
Fix the use-after-free by moving fwnode_property_read_u32() before the endpoint is parsed and freed. Avoid the error leak by not assigning the result of fwnode_property_read_u32() to 'ret'.
Which versions are affected by CVE-2026-89888?
How do I fix CVE-2026-89888?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89888 being exploited?
There is no known exploitation of CVE-2026-89888 in the wild and no public exploit code.
Sources
Also known as AZL-101361, BELL-CVE-2026-89888, DEBIAN-CVE-2026-89888, GHSA-4c55-f2c6-f257, UBUNTU-CVE-2026-89888.