CVE-2026-93101: media: v4l2-async: Unregister sub-device if asc_list is empty
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-async: Unregister sub-device if asclist is empty
When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes.
The cause is that the tvp5150 i2c module uses v4l2async, but the em28xx driver does not since it predates v4l2async.
In that corner case sd->asclist is empty, so v4l2asyncunregistersubdev() never calls v4l2deviceunregistersubdev().
Modify the code so that, if sd->asclist is empty, v4l2deviceunregistersubdev() is still called.
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by this crash scenario?
The described scenario involves an em28xx USB device using the I2C tvp5150 driver, where tvp5150 uses v4l2_async but the em28xx driver does not. The crash occurs when that USB device is disconnected.
What condition triggers the issue during device removal?
The affected corner case occurs when the sub-device's asc_list is empty. In that state, v4l2_async_unregister_subdev() does not call v4l2_device_unregister_subdev(), leaving the sub-device unregistered incorrectly during disconnect.
What does the fix change?
The fix ensures that v4l2_device_unregister_subdev() is called even when sd->asc_list is empty. This addresses the missing sub-device unregistration in the described device-disconnect path.