CVE-2026-89892: media: em28xx: defer audio-only extension registration
In the Linux kernel, the following vulnerability has been resolved:
media: em28xx: defer audio-only extension registration
The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before devnext is created. The duplicate device inherits isaudioonly and is then independently inserted into em28xxdevlist.
The list is intended to contain only primary devices: extension operations reach the secondary device through devnext. The independently linked secondary can be freed during disconnect while its list node remains reachable, resulting in a use-after-free.
Defer audio-only extension registration to the module-request work item. It runs only after probing has completed construction of the optional secondary device, so only the primary is registered and extension callbacks reach the secondary through devnext.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel em28xx media driver with an affected dual-TS board on the audio-only probing path are exposed. The issue depends on creation of the optional secondary device after audio-only extension registration has already occurred.
What condition triggers the use-after-free?
The secondary device is independently added to em28xx_devlist even though that list is intended to contain only primary devices. During device disconnect, the secondary can be freed while its still-reachable list node remains present, allowing later extension operations to access freed memory.
How does the resolved behavior prevent the issue?
Extension registration is deferred to the module-request work item, which runs after probing has finished constructing any optional secondary device. This ensures that only the primary device is registered and extension callbacks access the secondary through dev_next.