CVE-2026-89888: media: i2c: ov02a10: fix endpoint parsing use-after-free
In the Linux kernel, the following vulnerability has been resolved:
media: i2c: ov02a10: fix endpoint parsing use-after-free
The ov02a10checkhwcfg() function calls fwnodehandleput(ep) immediately after allocating and parsing the endpoint. However, it subsequently calls fwnodepropertyreadu32() using the same 'ep' handle, leading to a potential use-after-free.
Additionally, reading the optional 'ovti,mipi-clock-voltage' property used to overwrite the 'ret' variable. If the property was missing, 'ret' would become negative, and this failure code would be incorrectly returned at the end of the function, causing probe to fail entirely.
Fix the use-after-free by moving fwnodepropertyreadu32() before the endpoint is parsed and freed. Avoid the error leak by not assigning the result of fwnodepropertyreadu32() to 'ret'.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the kernel fix for media/i2c ov02a10 to prevent the use-after-free during endpoint parsing (ensure fwnode_property_read_u32() is called before fwnode_handle_put(ep) in ov02a10_check_hwcfg()).
Event History
Frequently Asked Questions
Which systems are affected in practice?
Systems using the Linux ov02a10 media I2C driver are affected when the driver probes the device and validates its firmware endpoint configuration.
What configuration can cause an immediately visible failure?
If the optional "ovti,mipi-clock-voltage" property is absent, the vulnerable code can incorrectly preserve that missing-property error and fail the device probe entirely.
When is the use-after-free reached?
It is reached during hardware-configuration checking when the driver releases the endpoint handle and then attempts to read a property through the same handle.