CVE-2026-89871: media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
In the Linux kernel, the following vulnerability has been resolved:
media: video-i2c: fix kthread error pointer left in kthreadvidcap on failure
kthreadrun() returns an ERRPTR on failure, not NULL. When startstreaming() fails, data->kthreadvidcap is left holding this error pointer instead of being cleared.
This causes two subsequent bugs: 1. A future call to startstreaming() sees a non-NULL kthreadvidcap and returns 0 (success) immediately, without actually starting the capture thread. 2. A call to stopstreaming() checks 'kthreadvidcap == NULL' which is false for an error pointer, and proceeds to call kthreadstop() on the error pointer, leading to a kernel crash.
Fix this by resetting kthreadvidcap to NULL on failure before jumping to the error path.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the crash?
The capture thread must first fail to start, causing kthread_run() to return an error pointer. A subsequent stop_streaming() call can then pass that error pointer to kthread_stop(), resulting in a kernel crash.
What happens if streaming is started again after the initial thread-start failure?
A later start_streaming() call can incorrectly report success because the stored error pointer is non-NULL. The capture thread is not actually started in that case.
How can systems that cannot patch immediately reduce the risk?
Avoid retrying streaming startup or invoking stream stop after a capture-thread startup failure. The failure state is what leaves the invalid pointer in place and enables the later incorrect success result or crash.