Vulnerability-Lookup

FKIE_CVE-2026-89888

Vulnerability from fkie_nvd - Published: 2026-09-16 11:16 - Updated: 2026-09-16 15:18

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov02a10: fix endpoint parsing use-after-free The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint. However, it subsequently calls fwnode_property_read_u32() using the same 'ep' handle, leading to a potential use-after-free. Additionally, reading the optional 'ovti,mipi-clock-voltage' property used to overwrite the 'ret' variable. If the property was missing, 'ret' would become negative, and this failure code would be incorrectly returned at the end of the function, causing probe to fail entirely. Fix the use-after-free by moving fwnode_property_read_u32() before the endpoint is parsed and freed. Avoid the error leak by not assigning the result of fwnode_property_read_u32() to 'ret'.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/213b2489130357c8d3e8d4fb2bdab88791ce3185
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4c2988bf1ad2753240a38db10ce23e87ec542f8f
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6e13784452785cd8402b228bea53bc6a027ade84
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8ddb3b69f67b0632ff3830da18de3e8dcaf5884b
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/90f9b421fc6d4f2edab7521efdb1e58571468d33
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/94971ba0592ca77ec99b292226a4b398763315b8
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9de48ba68f56de9fe20ebd3f9728d22af25f9a91

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/i2c/ov02a10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9de48ba68f56de9fe20ebd3f9728d22af25f9a91",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "8ddb3b69f67b0632ff3830da18de3e8dcaf5884b",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "4c2988bf1ad2753240a38db10ce23e87ec542f8f",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "213b2489130357c8d3e8d4fb2bdab88791ce3185",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "90f9b421fc6d4f2edab7521efdb1e58571468d33",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "6e13784452785cd8402b228bea53bc6a027ade84",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "94971ba0592ca77ec99b292226a4b398763315b8",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/i2c/ov02a10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ov02a10: fix endpoint parsing use-after-free\n\nThe ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)\nimmediately after allocating and parsing the endpoint. However, it\nsubsequently calls fwnode_property_read_u32() using the same \u0027ep\u0027\nhandle, leading to a potential use-after-free.\n\nAdditionally, reading the optional \u0027ovti,mipi-clock-voltage\u0027 property\nused to overwrite the \u0027ret\u0027 variable. If the property was missing,\n\u0027ret\u0027 would become negative, and this failure code would be incorrectly\nreturned at the end of the function, causing probe to fail entirely.\n\nFix the use-after-free by moving fwnode_property_read_u32() before\nthe endpoint is parsed and freed. Avoid the error leak by not\nassigning the result of fwnode_property_read_u32() to \u0027ret\u0027."
    }
  ],
  "id": "CVE-2026-89888",
  "lastModified": "2026-09-16T15:18:15.367",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-16T11:16:57.347",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/213b2489130357c8d3e8d4fb2bdab88791ce3185"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4c2988bf1ad2753240a38db10ce23e87ec542f8f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6e13784452785cd8402b228bea53bc6a027ade84"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8ddb3b69f67b0632ff3830da18de3e8dcaf5884b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/90f9b421fc6d4f2edab7521efdb1e58571468d33"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/94971ba0592ca77ec99b292226a4b398763315b8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9de48ba68f56de9fe20ebd3f9728d22af25f9a91"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-89888 (GCVE-0-2026-89888)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39

Title

media: i2c: ov02a10: fix endpoint parsing use-after-free

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/9de48ba68f56de9fe…
https://git.kernel.org/stable/c/8ddb3b69f67b0632f…
https://git.kernel.org/stable/c/4c2988bf1ad275324…
https://git.kernel.org/stable/c/213b2489130357c8d…
https://git.kernel.org/stable/c/90f9b421fc6d4f2ed…
https://git.kernel.org/stable/c/6e13784452785cd84…
https://git.kernel.org/stable/c/94971ba0592ca77ec…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 9de48ba68f56de9fe20ebd3f9728d22af25f9a91 (git) Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 8ddb3b69f67b0632ff3830da18de3e8dcaf5884b (git) Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 4c2988bf1ad2753240a38db10ce23e87ec542f8f (git) Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 213b2489130357c8d3e8d4fb2bdab88791ce3185 (git) Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 90f9b421fc6d4f2edab7521efdb1e58571468d33 (git) Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 6e13784452785cd8402b228bea53bc6a027ade84 (git) Affected: 91807efbe8ec7f591085067d9f96a112e015274b , < 94971ba0592ca77ec99b292226a4b398763315b8 (git)
Linux	Linux	Affected: 5.11 Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/i2c/ov02a10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9de48ba68f56de9fe20ebd3f9728d22af25f9a91",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "8ddb3b69f67b0632ff3830da18de3e8dcaf5884b",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "4c2988bf1ad2753240a38db10ce23e87ec542f8f",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "213b2489130357c8d3e8d4fb2bdab88791ce3185",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "90f9b421fc6d4f2edab7521efdb1e58571468d33",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "6e13784452785cd8402b228bea53bc6a027ade84",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            },
            {
              "lessThan": "94971ba0592ca77ec99b292226a4b398763315b8",
              "status": "affected",
              "version": "91807efbe8ec7f591085067d9f96a112e015274b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/i2c/ov02a10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ov02a10: fix endpoint parsing use-after-free\n\nThe ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)\nimmediately after allocating and parsing the endpoint. However, it\nsubsequently calls fwnode_property_read_u32() using the same \u0027ep\u0027\nhandle, leading to a potential use-after-free.\n\nAdditionally, reading the optional \u0027ovti,mipi-clock-voltage\u0027 property\nused to overwrite the \u0027ret\u0027 variable. If the property was missing,\n\u0027ret\u0027 would become negative, and this failure code would be incorrectly\nreturned at the end of the function, causing probe to fail entirely.\n\nFix the use-after-free by moving fwnode_property_read_u32() before\nthe endpoint is parsed and freed. Avoid the error leak by not\nassigning the result of fwnode_property_read_u32() to \u0027ret\u0027."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The use-after-free is in ov02a10_check_hwcfg() on the I2C probe path of the onboard OmniVision OV02A10 MIPI CSI-2 camera sensor (MediaTek phones, IoT cameras). It is reached only via local driver bind (boot, module load, or sysfs), not via network packets, Bluetooth/Wi-Fi, or USB.\nAC:L - After v4l2_fwnode_endpoint_alloc_parse() succeeds, fwnode_handle_put(ep) is immediately followed by fwnode_property_read_u32(ep) on every probe with no race or attacker-uncontrollable layout. A local attacker who rebinds the driver or is present for boot/deferred probe triggers it reliably.\nPR:L - ov02a10_probe() runs automatically at boot on DT-described OV02A10 cameras with no capable() check; sysfs bind is 0200, but CNA practice scores ambiguous probe/bind gating as Low rather than init-namespace root. An unprivileged local user on the phone or kiosk is sufficient.\nUI:N - The dangling endpoint fwnode is consumed inside driver probe itself. No victim must open /dev/v4l-subdev*, mount a filesystem, or plug in hardware.\nS:U - The fwnode/device_node use-after-free corrupts host-kernel heap within the same security authority. This is standard in-kernel memory corruption, not a VM escape, IOMMU/DMA bypass, or sandbox breakout.\nC:H - fwnode_property_read_u32() calls fwnode_call_int_op(), which reads fwnode-\u003eops from the endpoint after its reference was dropped. On dynamic OF overlay or software-node graphs that free on last put, that slab use-after-free read is Confidentiality High per UAF guidance.\nI:H - The same dangling fwnode_handle.ops is dispatched as property_read_int_array(); reclaiming the freed node with a forged ops table yields an indirect call and control-flow hijack. Kernel guidance scores use-after-free as Integrity High.\nA:H - Dispatch through a freed fwnode ops pointer oopses or panics the kernel during camera probe on affected phones and embedded devices. Any use-after-free is Availability High even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:38.808Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9de48ba68f56de9fe20ebd3f9728d22af25f9a91"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ddb3b69f67b0632ff3830da18de3e8dcaf5884b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c2988bf1ad2753240a38db10ce23e87ec542f8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/213b2489130357c8d3e8d4fb2bdab88791ce3185"
        },
        {
          "url": "https://git.kernel.org/stable/c/90f9b421fc6d4f2edab7521efdb1e58571468d33"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e13784452785cd8402b228bea53bc6a027ade84"
        },
        {
          "url": "https://git.kernel.org/stable/c/94971ba0592ca77ec99b292226a4b398763315b8"
        }
      ],
      "title": "media: i2c: ov02a10: fix endpoint parsing use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89888",
    "datePublished": "2026-09-16T10:31:51.892Z",
    "dateReserved": "2026-09-11T19:38:34.773Z",
    "dateUpdated": "2026-09-16T14:39:38.808Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-89888

CVE-2026-89888 (GCVE-0-2026-89888)

Tags

Sightings

Nomenclature

Related by attack behaviour