CVE-2026-89888 (GCVE-0-2026-89888)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39
VLAI
Title
media: i2c: ov02a10: fix endpoint parsing use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov02a10: fix endpoint parsing use-after-free The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint. However, it subsequently calls fwnode_property_read_u32() using the same 'ep' handle, leading to a potential use-after-free. Additionally, reading the optional 'ovti,mipi-clock-voltage' property used to overwrite the 'ret' variable. If the property was missing, 'ret' would become negative, and this failure code would be incorrectly returned at the end of the function, causing probe to fail entirely. Fix the use-after-free by moving fwnode_property_read_u32() before the endpoint is parsed and freed. Avoid the error leak by not assigning the result of fwnode_property_read_u32() to 'ret'.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 9de48ba68f56de9fe20ebd3f9728d22af25f9a91 (git)
Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 8ddb3b69f67b0632ff3830da18de3e8dcaf5884b (git)
Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 4c2988bf1ad2753240a38db10ce23e87ec542f8f (git)
Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 213b2489130357c8d3e8d4fb2bdab88791ce3185 (git)
Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 90f9b421fc6d4f2edab7521efdb1e58571468d33 (git)
Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 6e13784452785cd8402b228bea53bc6a027ade84 (git)
Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 94971ba0592ca77ec99b292226a4b398763315b8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/i2c/ov02a10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9de48ba68f56de9fe20ebd3f9728d22af25f9a91",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "8ddb3b69f67b0632ff3830da18de3e8dcaf5884b",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "4c2988bf1ad2753240a38db10ce23e87ec542f8f",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "213b2489130357c8d3e8d4fb2bdab88791ce3185",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "90f9b421fc6d4f2edab7521efdb1e58571468d33",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "6e13784452785cd8402b228bea53bc6a027ade84",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "94971ba0592ca77ec99b292226a4b398763315b8",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/i2c/ov02a10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ov02a10: fix endpoint parsing use-after-free\n\nThe ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)\nimmediately after allocating and parsing the endpoint. However, it\nsubsequently calls fwnode_property_read_u32() using the same \u0027ep\u0027\nhandle, leading to a potential use-after-free.\n\nAdditionally, reading the optional \u0027ovti,mipi-clock-voltage\u0027 property\nused to overwrite the \u0027ret\u0027 variable. If the property was missing,\n\u0027ret\u0027 would become negative, and this failure code would be incorrectly\nreturned at the end of the function, causing probe to fail entirely.\n\nFix the use-after-free by moving fwnode_property_read_u32() before\nthe endpoint is parsed and freed. Avoid the error leak by not\nassigning the result of fwnode_property_read_u32() to \u0027ret\u0027."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The use-after-free is in ov02a10_check_hwcfg() on the I2C probe path of the onboard OmniVision OV02A10 MIPI CSI-2 camera sensor (MediaTek phones, IoT cameras). It is reached only via local driver bind (boot, module load, or sysfs), not via network packets, Bluetooth/Wi-Fi, or USB.\nAC:L - After v4l2_fwnode_endpoint_alloc_parse() succeeds, fwnode_handle_put(ep) is immediately followed by fwnode_property_read_u32(ep) on every probe with no race or attacker-uncontrollable layout. A local attacker who rebinds the driver or is present for boot/deferred probe triggers it reliably.\nPR:L - ov02a10_probe() runs automatically at boot on DT-described OV02A10 cameras with no capable() check; sysfs bind is 0200, but CNA practice scores ambiguous probe/bind gating as Low rather than init-namespace root. An unprivileged local user on the phone or kiosk is sufficient.\nUI:N - The dangling endpoint fwnode is consumed inside driver probe itself. No victim must open /dev/v4l-subdev*, mount a filesystem, or plug in hardware.\nS:U - The fwnode/device_node use-after-free corrupts host-kernel heap within the same security authority. This is standard in-kernel memory corruption, not a VM escape, IOMMU/DMA bypass, or sandbox breakout.\nC:H - fwnode_property_read_u32() calls fwnode_call_int_op(), which reads fwnode-\u003eops from the endpoint after its reference was dropped. On dynamic OF overlay or software-node graphs that free on last put, that slab use-after-free read is Confidentiality High per UAF guidance.\nI:H - The same dangling fwnode_handle.ops is dispatched as property_read_int_array(); reclaiming the freed node with a forged ops table yields an indirect call and control-flow hijack. Kernel guidance scores use-after-free as Integrity High.\nA:H - Dispatch through a freed fwnode ops pointer oopses or panics the kernel during camera probe on affected phones and embedded devices. Any use-after-free is Availability High even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:38.808Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9de48ba68f56de9fe20ebd3f9728d22af25f9a91"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ddb3b69f67b0632ff3830da18de3e8dcaf5884b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c2988bf1ad2753240a38db10ce23e87ec542f8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/213b2489130357c8d3e8d4fb2bdab88791ce3185"
        },
        {
          "url": "https://git.kernel.org/stable/c/90f9b421fc6d4f2edab7521efdb1e58571468d33"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e13784452785cd8402b228bea53bc6a027ade84"
        },
        {
          "url": "https://git.kernel.org/stable/c/94971ba0592ca77ec99b292226a4b398763315b8"
        }
      ],
      "title": "media: i2c: ov02a10: fix endpoint parsing use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89888",
    "datePublished": "2026-09-16T10:31:51.892Z",
    "dateReserved": "2026-09-11T19:38:34.773Z",
    "dateUpdated": "2026-09-16T14:39:38.808Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89888",
      "date": "2026-09-25",
      "epss": "0.00171",
      "percentile": "0.05723"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T02:20:49.000Z",
      "cve": "CVE-2026-89888",
      "id": "msrc_CVE-2026-89888",
      "initial_release_date": "2026-09-17T01:14:09.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "media: i2c: ov02a10: fix endpoint parsing use-after-free",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89888.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/i2c/ov02a10.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9de48ba68f56de9fe20ebd3f9728d22af25f9a91",
                    "status": "affected",
                    "version": "91807efbe8ec7f591085067d9f96a112e015274b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8ddb3b69f67b0632ff3830da18de3e8dcaf5884b",
                    "status": "affected",
                    "version": "91807efbe8ec7f591085067d9f96a112e015274b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4c2988bf1ad2753240a38db10ce23e87ec542f8f",
                    "status": "affected",
                    "version": "91807efbe8ec7f591085067d9f96a112e015274b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "213b2489130357c8d3e8d4fb2bdab88791ce3185",
                    "status": "affected",
                    "version": "91807efbe8ec7f591085067d9f96a112e015274b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "90f9b421fc6d4f2edab7521efdb1e58571468d33",
                    "status": "affected",
                    "version": "91807efbe8ec7f591085067d9f96a112e015274b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6e13784452785cd8402b228bea53bc6a027ade84",
                    "status": "affected",
                    "version": "91807efbe8ec7f591085067d9f96a112e015274b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "94971ba0592ca77ec99b292226a4b398763315b8",
                    "status": "affected",
                    "version": "91807efbe8ec7f591085067d9f96a112e015274b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/i2c/ov02a10.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.11"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ov02a10: fix endpoint parsing use-after-free\n\nThe ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)\nimmediately after allocating and parsing the endpoint. However, it\nsubsequently calls fwnode_property_read_u32() using the same \u0027ep\u0027\nhandle, leading to a potential use-after-free.\n\nAdditionally, reading the optional \u0027ovti,mipi-clock-voltage\u0027 property\nused to overwrite the \u0027ret\u0027 variable. If the property was missing,\n\u0027ret\u0027 would become negative, and this failure code would be incorrectly\nreturned at the end of the function, causing probe to fail entirely.\n\nFix the use-after-free by moving fwnode_property_read_u32() before\nthe endpoint is parsed and freed. Avoid the error leak by not\nassigning the result of fwnode_property_read_u32() to \u0027ret\u0027."
          }
        ],
        "id": "CVE-2026-89888",
        "lastModified": "2026-09-16T15:18:15.367",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:57.347",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/213b2489130357c8d3e8d4fb2bdab88791ce3185"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4c2988bf1ad2753240a38db10ce23e87ec542f8f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6e13784452785cd8402b228bea53bc6a027ade84"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8ddb3b69f67b0632ff3830da18de3e8dcaf5884b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/90f9b421fc6d4f2edab7521efdb1e58571468d33"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/94971ba0592ca77ec99b292226a4b398763315b8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9de48ba68f56de9fe20ebd3f9728d22af25f9a91"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.