CVE-2026-89734: usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit()
In uvcgvideoinit(), if kthreadrunworker() fails, the error logged uses uvcgerr(), however, the pointer it uses: video->uvc is not assigned at this point, triggering a null pointer dereference. Fix this by directly using uvc->func which is assigned already.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the null pointer dereference?
The failure path is reached when kthread_run_worker() fails during uvcg_video_init(). The subsequent error logging dereferences video->uvc before that pointer has been assigned.
Which systems are potentially exposed?
Systems using the Linux kernel USB gadget UVC functionality may be exposed if they reach this worker-creation failure path. The provided data does not identify specific kernel versions, configurations, or affected distributions.
What is the mitigation if the fix cannot be applied immediately?
No workaround or configuration-based mitigation is provided. Reducing reliance on the USB gadget UVC functionality may avoid reaching the affected initialization path, but the data does not specify a supported mitigation.