CVE-2026-89892 media: em28xx: defer audio-only extension registration
A use-after-free in the Linux kernel em28xx driver allows local attackers to execute code or escalate privileges via a race condition during device probing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89892?
CVE-2026-89892 is an use after free vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: em28xx: defer audio-only extension registration
The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before dev_next is created. The duplicate device inherits is_audio_only and is then independently inserted into em28xx_devlist.
The list is intended to contain only primary devices: extension operations reach the secondary device through dev_next. The independently linked secondary can be freed during disconnect while its list node remains reachable, resulting in a use-after-free.
Defer audio-only extension registration to the module-request work item. It runs only after probing has completed construction of the optional secondary device, so only the primary is registered and extension callbacks reach the secondary through dev_next.
Which versions are affected by CVE-2026-89892?
How do I fix CVE-2026-89892?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89892 being exploited?
There is no known exploitation of CVE-2026-89892 in the wild and no public exploit code.
Sources
Also known as AZL-101174, BELL-CVE-2026-89892, DEBIAN-CVE-2026-89892, GHSA-gv4g-vvq5-j6r7, UBUNTU-CVE-2026-89892.