CVE-2026-89734: usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit()
In uvcgvideoinit(), if kthreadrunworker() fails, the error logged uses uvcgerr(), however, the pointer it uses: video->uvc is not assigned at this point, triggering a null pointer dereference. Fix this by directly using uvc->func which is assigned already.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In uvcg_video_init(), fix the error logging path when kthread_run_worker() fails by using uvc->func directly, since it is already assigned, instead of the unassigned video->uvc pointer.
Event History
Frequently Asked Questions
What condition is required to trigger the null pointer dereference?
The failure path is reached when kthread_run_worker() fails during uvcg_video_init(). The subsequent error logging dereferences video->uvc before that pointer has been assigned.
Which systems are potentially exposed?
Systems using the Linux kernel USB gadget UVC functionality may be exposed if they reach this worker-creation failure path. The provided data does not identify specific kernel versions, configurations, or affected distributions.
What is the mitigation if the fix cannot be applied immediately?
No workaround or configuration-based mitigation is provided. Reducing reliance on the USB gadget UVC functionality may avoid reaching the affected initialization path, but the data does not specify a supported mitigation.