CVE-2026-89874: media: v4l2-async: avoid deleting unlinked ASC entry on link error
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-async: avoid deleting unlinked ASC entry on link error
v4l2asyncmatchnotify() creates ancillary media links before adding asc->ascsubdeventry to sd->asclist.
If ancillary link creation fails, the function jumps to errcallunbind while ascsubdeventry has not been linked yet. Async connections are zero-allocated, so the list entry still has NULL next and prev pointers on this path. Calling listdel() on it can therefore dereference NULL instead of returning the original link creation error.
Do not delete ascsubdeventry from errcallunbind. There is no list insertion to undo on this path; the bound callback and sub-device registration are the operations that need to be rolled back.
Event History
Frequently Asked Questions
What condition is required to reach the vulnerable path?
Ancillary media-link creation must fail during v4l2_async_match_notify() before asc->asc_subdev_entry has been added to the sub-device's asc_list. The subsequent error handling then attempts to delete the unlinked list entry.
What is the practical effect of this failure?
Because the async connection is zero-allocated, the unlinked list entry has NULL next and previous pointers. Calling list_del() on it can dereference NULL rather than returning the original ancillary link-creation error.
Is the normal successful registration path involved?
No. The issue is specific to the error path taken when ancillary media-link creation fails before list insertion occurs.