CVE-2026-93101 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-async: Unregister sub-device if asc_list is empty
When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes.
The cause is that the tvp5150 i2c module uses v4l2_async, but the em28xx driver does not since it predates v4l2_async.
In that corner case sd->asc_list is empty, so v4l2_async_unregister_subdev() never calls v4l2_device_unregister_subdev().
Modify the code so that, if sd->asc_list is empty, v4l2_device_unregister_subdev() is still called.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel media subsystem relies heavily on asynchronous device registration mechanisms to manage complex hardware topologies where components may not be available at boot time or may be hot-plugged and unplugged dynamically. The vulnerability described involves a critical logic error within the v4l2_async framework, specifically in the handling of sub-device unregistration when an associated async list is empty. This issue manifests primarily with legacy drivers such as em28xx that do not utilize the modern v4l2_async infrastructure for their own registration but interact with subsystem components like the tvp5150 i2c driver which do rely on it. When a USB device utilizing this configuration is disconnected, the kernel attempts to clean up the associated media entities and sub-devices. However, because the em28xx driver predates v4l2_async, its internal state does not populate the asc_list for the connected sub-device in the manner expected by the async unregistration logic.
The technical flaw lies in a conditional check within the v4l2_async_unregister_subdev function. The code assumes that if sd->asc_list is empty, there are no asynchronous references to manage and therefore skips calling v4l2_device_unregister_subdev. This assumption fails when dealing with mixed environments where legacy drivers coexist with async-enabled modules. By skipping this call, the kernel fails to properly decrement reference counts or remove the sub-device from the central media device list. Consequently, dangling pointers remain in memory structures that expect the sub-device to be fully unregistered. When subsequent operations attempt to access these stale references during further disconnection events or system shutdowns, a null pointer dereference occurs, leading to an immediate kernel panic and system crash.
This vulnerability is classified under CWE-416, Use After Free, as it results in the use of memory that has not been properly cleaned up due to skipped deallocation logic. From an operational perspective, this represents a significant stability risk for systems relying on USB-based media capture devices with mixed driver architectures. The impact is severe, resulting in complete system unavailability until rebooted and potential data loss if active recording sessions are interrupted abruptly. Attackers could potentially exploit this by triggering repeated device disconnects to cause denial of service against the host machine or any virtualized environment running such hardware configurations.
Mitigation strategies involve applying kernel patches that correct the logic within v4l2_async_unregister_subdev to ensure v4l2_device_unregister_subdev is always called regardless of whether asc_list is empty, provided other safety checks pass. System administrators should prioritize updating their Linux kernels to versions where this specific media subsystem fix has been merged and released. For environments unable to update immediately, avoiding the disconnection of affected USB devices while they are in use or ensuring that legacy drivers like em28xx are not paired with async-dependent i2c modules can serve as a temporary workaround. Long-term resolution requires migrating legacy drivers to adopt v4l2_async standards for consistency and robustness in device lifecycle management, aligning with modern kernel development practices outlined in ATT&CK techniques related to system availability impact through resource exhaustion or instability induction.