CVE-2026-89871: media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure

Published Sep 16, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

media: video-i2c: fix kthread error pointer left in kthreadvidcap on failure

kthreadrun() returns an ERRPTR on failure, not NULL. When startstreaming() fails, data->kthreadvidcap is left holding this error pointer instead of being cleared.

This causes two subsequent bugs: 1. A future call to startstreaming() sees a non-NULL kthreadvidcap and returns 0 (success) immediately, without actually starting the capture thread. 2. A call to stopstreaming() checks 'kthreadvidcap == NULL' which is false for an error pointer, and proceeds to call kthreadstop() on the error pointer, leading to a kernel crash.

Fix this by resetting kthreadvidcap to NULL on failure before jumping to the error path.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 16, 2026
CVE Published
via MITRE·10:31 AM
Data Sourced
via MITRE·10:31 AM
Description

Frequently Asked Questions

1

What condition is required to trigger the crash?

The capture thread must first fail to start, causing kthread_run() to return an error pointer. A subsequent stop_streaming() call can then pass that error pointer to kthread_stop(), resulting in a kernel crash.

2

What happens if streaming is started again after the initial thread-start failure?

A later start_streaming() call can incorrectly report success because the stored error pointer is non-NULL. The capture thread is not actually started in that case.

3

How can systems that cannot patch immediately reduce the risk?

Avoid retrying streaming startup or invoking stream stop after a capture-thread startup failure. The failure state is what leaves the invalid pointer in place and enables the later incorrect success result or crash.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203