CVE-2026-89888

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov02a10: fix endpoint parsing use-after-free The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint. However, it subsequently calls fwnode_property_read_u32() using the same 'ep' handle, leading to a potential use-after-free. Additionally, reading the optional 'ovti,mipi-clock-voltage' property used to overwrite the 'ret' variable. If the property was missing, 'ret' would become negative, and this failure code would be incorrectly returned at the end of the function, causing probe to fail entirely. Fix the use-after-free by moving fwnode_property_read_u32() before the endpoint is parsed and freed. Avoid the error leak by not assigning the result of fwnode_property_read_u32() to 'ret'.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/213b2489130357c8d3e8d4fb2bdab88791ce3185
https://git.kernel.org/stable/c/4c2988bf1ad2753240a38db10ce23e87ec542f8f
https://git.kernel.org/stable/c/6e13784452785cd8402b228bea53bc6a027ade84
https://git.kernel.org/stable/c/8ddb3b69f67b0632ff3830da18de3e8dcaf5884b
https://git.kernel.org/stable/c/90f9b421fc6d4f2edab7521efdb1e58571468d33
https://git.kernel.org/stable/c/94971ba0592ca77ec99b292226a4b398763315b8
https://git.kernel.org/stable/c/9de48ba68f56de9fe20ebd3f9728d22af25f9a91

Configurations

No configuration.

History

16 Sep 2026, 15:18

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8

Information

Published : 2026-09-16 11:16

Updated : 2026-09-16 15:18

NVD link : CVE-2026-89888

Mitre link : CVE-2026-89888

CVE.ORG link : CVE-2026-89888

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-89888", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "91807efbe8ec7f591085067d9f96a112e015274b", "lessThan": "9de48ba68f56de9fe20ebd3f9728d22af25f9a91", "versionType": "git"}, {"status": "affected", "version": "91807efbe8ec7f591085067d9f96a112e015274b", "lessThan": "8ddb3b69f67b0632ff3830da18de3e8dcaf5884b", "versionType": "git"}, {"status": "affected", "version": "91807efbe8ec7f591085067d9f96a112e015274b", "lessThan": "4c2988bf1ad2753240a38db10ce23e87ec542f8f", "versionType": "git"}, {"status": "affected", "version": "91807efbe8ec7f591085067d9f96a112e015274b", "lessThan": "213b2489130357c8d3e8d4fb2bdab88791ce3185", "versionType": "git"}, {"status": "affected", "version": "91807efbe8ec7f591085067d9f96a112e015274b", "lessThan": "90f9b421fc6d4f2edab7521efdb1e58571468d33", "versionType": "git"}, {"status": "affected", "version": "91807efbe8ec7f591085067d9f96a112e015274b", "lessThan": "6e13784452785cd8402b228bea53bc6a027ade84", "versionType": "git"}, {"status": "affected", "version": "91807efbe8ec7f591085067d9f96a112e015274b", "lessThan": "94971ba0592ca77ec99b292226a4b398763315b8", "versionType": "git"}], "programFiles": ["drivers/media/i2c/ov02a10.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"status": "unaffected", "version": "0", "lessThan": "5.11", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.221", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.188", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.157", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.110", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.51", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.5", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/media/i2c/ov02a10.c"], "defaultStatus": "affected"}]}], "published": "2026-09-16T11:16:57.347", "references": [{"url": "https://git.kernel.org/stable/c/213b2489130357c8d3e8d4fb2bdab88791ce3185", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4c2988bf1ad2753240a38db10ce23e87ec542f8f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6e13784452785cd8402b228bea53bc6a027ade84", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8ddb3b69f67b0632ff3830da18de3e8dcaf5884b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/90f9b421fc6d4f2edab7521efdb1e58571468d33", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/94971ba0592ca77ec99b292226a4b398763315b8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9de48ba68f56de9fe20ebd3f9728d22af25f9a91", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ov02a10: fix endpoint parsing use-after-free\n\nThe ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)\nimmediately after allocating and parsing the endpoint. However, it\nsubsequently calls fwnode_property_read_u32() using the same 'ep'\nhandle, leading to a potential use-after-free.\n\nAdditionally, reading the optional 'ovti,mipi-clock-voltage' property\nused to overwrite the 'ret' variable. If the property was missing,\n'ret' would become negative, and this failure code would be incorrectly\nreturned at the end of the function, causing probe to fail entirely.\n\nFix the use-after-free by moving fwnode_property_read_u32() before\nthe endpoint is parsed and freed. Avoid the error leak by not\nassigning the result of fwnode_property_read_u32() to 'ret'."}], "lastModified": "2026-09-16T15:18:15.367", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}