{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89901 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89901 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89901 and fix it if it is affected.\n\nWhat it is: CVE-2026-89901 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89901 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89901/ (Markdown: https://insights.sbomify.com/CVE-2026-89901/index.md)","id":"CVE-2026-89901","markdown":"https://insights.sbomify.com/CVE-2026-89901/index.md","name":"CVE-2026-89901","record":{"aliases":["AZL-101231","BELL-CVE-2026-89901","DEBIAN-CVE-2026-89901","GHSA-wfp4-jcv3-wqgx","UBUNTU-CVE-2026-89901"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"none","summary":"A NULL pointer dereference in the Linux kernel airspy driver allows local attackers to cause a system crash by disconnecting the device during streaming.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref\n\nairspy_disconnect() clears s-\u003eudev under v4l2_lock, but\nairspy_stop_streaming() unconditionally calls airspy_ctrl_msg() and\nairspy_free_stream_bufs() afterwards. If a streaming user closes the\ndevice after disconnect, stop_streaming() runs and dereferences the\nNULL s-\u003eudev:\n\n  airspy_stop_streaming()\n    airspy_ctrl_msg(s, CMD_RECEIVER_MODE, 0, 0, NULL, 0)\n      usb_sndctrlpipe(s-\u003eudev, 0)         /* NULL deref */\n    airspy_free_stream_bufs(s)\n      usb_free_coherent(s-\u003eudev, ...)     /* NULL deref */\n\nThe airspy driver uses vb2_fop_release() in its file_operations, so\nreplace video_unregister_device(\u0026s-\u003evdev) with\nvb2_video_unregister_device(\u0026s-\u003evdev) and move it before clearing\ns-\u003eudev. vb2_video_unregister_device() releases the vb2 queue, which\nsynchronously runs airspy_stop_streaming() if streaming is active, so\nthe URBs, coherent DMA stream buffers and the hardware stop control\nmessage all execute while s-\u003eudev is still valid.\n\nvb2_video_unregister_device() locks vdev-\u003equeue-\u003elock (vb_queue_lock)\ninternally, and stop_streaming() locks v4l2_lock, so the previous outer\nmutex_lock(\u0026s-\u003evb_queue_lock) / mutex_lock(\u0026s-\u003ev4l2_lock) pair around\nthe unregister sequence would self-deadlock and has been removed. A\nshort v4l2_lock critical section around s-\u003eudev = NULL remains so any\nioctl path that still holds the file descriptor sees coherent state.\n\nIssue identified by automated review of the INV-003 series at\nhttps://sashiko.dev/","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref","id":"CVE-2026-89901","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"LoongArch: Avoid preempt count underflow without probe","id":"CVE-2026-89902"},"packages":[],"prev":{"headline":"media: cec: core: Fix kmemleak due to missed rc_free_device() call","id":"CVE-2026-89900"},"products":["Linux"],"published":"2026-09-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A NULL pointer dereference in the Linux kernel airspy driver allows local attackers to cause a system crash by disconnecting the device during streaming.","url":"https://insights.sbomify.com/CVE-2026-89901/"}