GHSA-5FV9-JV39-XHGW
Vulnerability from github – Published: 2026-09-16 12:30 – Updated: 2026-09-16 12:30In the Linux kernel, the following vulnerability has been resolved:
media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
kthread_run() returns an ERR_PTR on failure, not NULL. When start_streaming() fails, data->kthread_vid_cap is left holding this error pointer instead of being cleared.
This causes two subsequent bugs: 1. A future call to start_streaming() sees a non-NULL kthread_vid_cap and returns 0 (success) immediately, without actually starting the capture thread. 2. A call to stop_streaming() checks 'kthread_vid_cap == NULL' which is false for an error pointer, and proceeds to call kthread_stop() on the error pointer, leading to a kernel crash.
Fix this by resetting kthread_vid_cap to NULL on failure before jumping to the error path.
{
"affected": [],
"aliases": [
"CVE-2026-89871"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T11:16:55Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure\n\nkthread_run() returns an ERR_PTR on failure, not NULL.\nWhen start_streaming() fails, data-\u003ekthread_vid_cap is left holding\nthis error pointer instead of being cleared.\n\nThis causes two subsequent bugs:\n1. A future call to start_streaming() sees a non-NULL kthread_vid_cap\n and returns 0 (success) immediately, without actually starting the\n capture thread.\n2. A call to stop_streaming() checks \u0027kthread_vid_cap == NULL\u0027 which\n is false for an error pointer, and proceeds to call kthread_stop()\n on the error pointer, leading to a kernel crash.\n\nFix this by resetting kthread_vid_cap to NULL on failure before\njumping to the error path.",
"id": "GHSA-5fv9-jv39-xhgw",
"modified": "2026-09-16T12:30:39Z",
"published": "2026-09-16T12:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89871"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0e7f2cd72a4f9268ee09a13b13f3339e7cc71557"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0fac63cac6689588da530764ccb6ba55ee8e4d8b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3d1b10d81fe54852ed953f4129577b733bbd6907"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/52fd9d80c0cea7bf09e7ee36cad316e5c39b7fe6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5c35d380bea60503c4fe0986fe1de6a3263282b3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/76e379754ba618989f6215be608d5c04774a611d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/968c5213e34c48d35febdfd09cf3dc58ad039140"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/db0f4531aa55cfb0171684ebfffe3ff04b79d5a8"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.