CVE-2026-89874: media: v4l2-async: avoid deleting unlinked ASC entry on link error
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-async: avoid deleting unlinked ASC entry on link error
v4l2asyncmatchnotify() creates ancillary media links before adding asc->ascsubdeventry to sd->asclist.
If ancillary link creation fails, the function jumps to errcallunbind while ascsubdeventry has not been linked yet. Async connections are zero-allocated, so the list entry still has NULL next and prev pointers on this path. Calling listdel() on it can therefore dereference NULL instead of returning the original link creation error.
Do not delete ascsubdeventry from errcallunbind. There is no list insertion to undo on this path; the bound callback and sub-device registration are the operations that need to be rolled back.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.51 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.5 - Compensating control
In v4l2_async_match_notify() error handling, do not delete asc_subdev_entry from err_call_unbind when ancillary link creation fails before the entry is linked; roll back the bound callback and sub-device registration instead.
Event History
Frequently Asked Questions
What condition is required to reach the vulnerable path?
Ancillary media-link creation must fail during v4l2_async_match_notify() before asc->asc_subdev_entry has been added to the sub-device's asc_list. The subsequent error handling then attempts to delete the unlinked list entry.
What is the practical effect of this failure?
Because the async connection is zero-allocated, the unlinked list entry has NULL next and previous pointers. Calling list_del() on it can dereference NULL rather than returning the original ancillary link-creation error.
Is the normal successful registration path involved?
No. The issue is specific to the error path taken when ancillary media-link creation fails before list insertion occurs.