CVE-2026-89892 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
media: em28xx: defer audio-only extension registration
The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before dev_next is created. The duplicate device inherits is_audio_only and is then independently inserted into em28xx_devlist.
The list is intended to contain only primary devices: extension operations reach the secondary device through dev_next. The independently linked secondary can be freed during disconnect while its list node remains reachable, resulting in a use-after-free.
Defer audio-only extension registration to the module-request work item. It runs only after probing has completed construction of the optional secondary device, so only the primary is registered and extension callbacks reach the secondary through dev_next.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified within the Linux kernel media subsystem specifically affects the em28xx driver, which manages USB video capture devices based on the Empia EM28XX chipset family. This flaw manifests as a use-after-free condition arising from improper device enumeration and extension registration sequencing during hardware initialization. The core issue lies in how audio-only extensions are registered relative to the creation of secondary devices on dual-TS (Transport Stream) boards. During the probing phase, where the kernel identifies and initializes new hardware, the driver incorrectly registers these audio-specific extensions while still processing the primary device node. At this specific stage in the initialization sequence for certain multi-stream configurations, the secondary or next device has not yet been fully constructed or linked into the system's internal data structures.
Because the registration occurs prematurely, the duplicate device inherits critical flags such as is_audio_only and proceeds to insert itself independently into the em28xx_devlist. This list is architecturally designed to contain only primary devices, serving as the main entry point for extension operations. The intended operational model relies on these extensions reaching secondary or downstream devices through a linked pointer known as dev_next rather than by having each device register its own independent instance in the global list. By allowing the secondary device to link itself independently, the driver violates this structural assumption, creating an orphaned node that exists outside the expected management hierarchy of primary devices.
The operational impact of this architectural violation becomes critical during hardware disconnection events. When a user unplugs or disconnects the USB device, the kernel initiates cleanup procedures that free the memory associated with the secondary device structure. However, because the secondary device had previously inserted itself into the em28xx_devlist as an independent entity, its list node remains reachable and active within the global data structures even after the underlying object has been deallocated. Subsequent operations on this list may attempt to access or invoke callbacks associated with that stale pointer, leading directly to a use-after-free vulnerability. This class of memory corruption can result in kernel panics, denial of service conditions where the system becomes unstable, or potentially more severe outcomes if an attacker can manipulate the freed memory contents to achieve arbitrary code execution within the kernel space.
From a classification perspective, this flaw aligns with CWE-416, Use After Free, as it involves referencing memory after it has been reclaimed by the system. It also relates to CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, insofar as the race condition between device probing completion and extension registration creates an inconsistent state that is not properly guarded against during teardown. In terms of attack vectors, this could be categorized under ATT&CK technique T1059, Command and Scripting Interpreter, if exploited to gain initial foothold via kernel exploitation leading to privilege escalation, or more broadly as part of local privilege escalation paths where memory corruption primitives are leveraged to bypass security controls like SMEP or SMAP.
To mitigate this vulnerability, the resolution involves deferring the registration of audio-only extensions until a later stage in the initialization process. Specifically, the fix moves the extension registration logic into a module-request work item that executes only after the probing phase has fully completed and constructed any optional secondary devices. This ensures that when extensions are registered, they apply exclusively to the primary device node. Consequently, all subsequent extension callbacks correctly propagate to secondary devices through the established dev_next linkage mechanism rather than via independent list entries. This structural correction eliminates the possibility of orphaned nodes persisting after disconnect events, thereby preventing the use-after-free condition and restoring the integrity of the em28xx_devlist management model. System administrators should ensure that kernel updates incorporating this fix are applied to affected distributions to maintain system stability and security posture against potential exploitation of media subsystem flaws.