GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89741 (GCVE-0-2026-89741)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-14 12:02
VLAI
Title
Revert "media: v4l2-dev: fix error handling in __video_register_device()"
Summary
In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-dev: fix error handling in __video_register_device()" This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a. The intentions of that patch were good, but it doesn't work. The idea is that if device_register fails, you have to do a put_device to let the ref counter release resources. However, the V4L2 API says that if video_register_device() fails, then you have to call video_device_release(), which kfree()s the video_device struct. But the put_device() will already have freed the struct, so you end up in a double-free scenario. There is not really a good way of fixing this without breaking video_register_device() into two parts, one that initializes everything, and one that does the actual device_register, and then converting all V4L2 drivers to this new model. That is a massive job, and it is very unlikely that device_register will fail. So rather than ending up in a double-free scenario, just revert this patch, and in that case we'll have a small memory leak. Which is a lot more robust.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e5c8e62ae551e0ad2e15412aa0c57c2856d59677 , < 8b998c171ed875e402e1fd1c5cd619e4ca05e9c1 (git)
Affected: 8b451a9a46f2bfc510e6d5c2492df91647586184 , < 3de14b4f681a1b3c6d375d98d9d37a55ebb85349 (git)
Affected: b6be1f5633eae200af2527e9eeb7f51be5739b0f , < 8027f82c0f5474ed72448e160ee9778051fa1f49 (git)
Affected: ae7b143e05b36fc69d6571751855946cc45064c6 , < 2ac009a65d2385e9f0799eaf9d9694a29153a161 (git)
Affected: 2429bb9fad88c8fa84c4956b0a21cf5afe5e92b7 , < 712ca1cf756de2557a116e0df55791bac0c9f99e (git)
Affected: 2a934fdb01db6458288fc9386d3d8ceba6dd551a , < aad08b5f67d2a8116e1a00bce2611c1513b10bce (git)
Affected: 2a934fdb01db6458288fc9386d3d8ceba6dd551a , < ce792b94e03882108019ba996c1a7c4d4e09be2c (git)
Affected: 2a934fdb01db6458288fc9386d3d8ceba6dd551a , < e7600f5cee5de14065f950807931d6e6d40fb2d7 (git)
Affected: ee141706e701356dda41c6fed9ee18bf427c28e3 (git)
Affected: 4451412739ed33a49b34624299394ee575116d0c (git)
Affected: 5.10.239 , < 5.10.270 (semver)
Affected: 5.15.186 , < 5.15.221 (semver)
Affected: 6.1.142 , < 6.1.188 (semver)
Affected: 6.6.95 , < 6.6.157 (semver)
Affected: 6.12.35 , < 6.12.109 (semver)
Affected: 5.4.295 , < 5.5 (semver)
Affected: 6.15.4 , < 6.16 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/v4l2-core/v4l2-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8b998c171ed875e402e1fd1c5cd619e4ca05e9c1",
              "status": "affected",
              "version": "e5c8e62ae551e0ad2e15412aa0c57c2856d59677",
              "versionType": "git"
            },
            {
              "lessThan": "3de14b4f681a1b3c6d375d98d9d37a55ebb85349",
              "status": "affected",
              "version": "8b451a9a46f2bfc510e6d5c2492df91647586184",
              "versionType": "git"
            },
            {
              "lessThan": "8027f82c0f5474ed72448e160ee9778051fa1f49",
              "status": "affected",
              "version": "b6be1f5633eae200af2527e9eeb7f51be5739b0f",
              "versionType": "git"
            },
            {
              "lessThan": "2ac009a65d2385e9f0799eaf9d9694a29153a161",
              "status": "affected",
              "version": "ae7b143e05b36fc69d6571751855946cc45064c6",
              "versionType": "git"
            },
            {
              "lessThan": "712ca1cf756de2557a116e0df55791bac0c9f99e",
              "status": "affected",
              "version": "2429bb9fad88c8fa84c4956b0a21cf5afe5e92b7",
              "versionType": "git"
            },
            {
              "lessThan": "aad08b5f67d2a8116e1a00bce2611c1513b10bce",
              "status": "affected",
              "version": "2a934fdb01db6458288fc9386d3d8ceba6dd551a",
              "versionType": "git"
            },
            {
              "lessThan": "ce792b94e03882108019ba996c1a7c4d4e09be2c",
              "status": "affected",
              "version": "2a934fdb01db6458288fc9386d3d8ceba6dd551a",
              "versionType": "git"
            },
            {
              "lessThan": "e7600f5cee5de14065f950807931d6e6d40fb2d7",
              "status": "affected",
              "version": "2a934fdb01db6458288fc9386d3d8ceba6dd551a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee141706e701356dda41c6fed9ee18bf427c28e3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4451412739ed33a49b34624299394ee575116d0c",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.270",
              "status": "affected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.221",
              "status": "affected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.109",
              "status": "affected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/v4l2-core/v4l2-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.10.239",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.15.186",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.142",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6.95",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.12.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.295",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"media: v4l2-dev: fix error handling in __video_register_device()\"\n\nThis reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a.\n\nThe intentions of that patch were good, but it doesn\u0027t work.\n\nThe idea is that if device_register fails, you have to do a put_device\nto let the ref counter release resources.\n\nHowever, the V4L2 API says that if video_register_device() fails, then\nyou have to call video_device_release(), which kfree()s the video_device\nstruct.\n\nBut the put_device() will already have freed the struct, so you end\nup in a double-free scenario.\n\nThere is not really a good way of fixing this without breaking\nvideo_register_device() into two parts, one that initializes everything,\nand one that does the actual device_register, and then converting all\nV4L2 drivers to this new model.\n\nThat is a massive job, and it is very unlikely that device_register\nwill fail.\n\nSo rather than ending up in a double-free scenario, just revert this\npatch, and in that case we\u0027ll have a small memory leak. Which is a lot\nmore robust."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The double-free is in __video_register_device(), reached from local V4L2 registration such as USB gadget UVC configfs UDC bind (uvc_function_bind \u2192 uvc_register_video) and usbfs/sysfs re-probe of USB cameras; dummy_hcd suffices and there is no remote packet path.\nAC:L - A local attacker can retry gadget bind or device re-probe under memory/resource pressure to make device_register() fail and take the put_device() error path; success does not depend on a victim-owned race or uninfluenced layout.\nPR:L - __video_register_device() and uvc_function_bind() perform no capable() check; Android/embedded HALs routinely delegate usb_gadget configfs to non-root, and desktop usbfs/video nodes are typically uaccess/video-group, so init-namespace root is not required.\nUI:N - The attacker performs the configfs UDC bind or local re-probe and applies resource pressure themselves; no separate victim mount, file-open, or cable-plug action is required.\nS:U - The heap double-free corrupts a kmalloc\u0027d video_device or the parent object freed by vdev-\u003erelease() inside the same host kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - On device_register() failure the buggy put_device() runs v4l2_device_release() which calls vdev-\u003erelease()/kfree, then callers such as video_device_release() or gspca/uvc probe error paths free the same object again, yielding a UAF disclosure primitive.\nI:H - The same double-free of struct video_device (or parent driver objects via vdev-\u003erelease, as in UVC kref_put/uvc_delete and gspca_release) is heap corruption that can be sprayed into an arbitrary write and control-flow hijack.\nA:H - The double-free and premature v4l2_device_release() (including media_devnode_remove() on a still-NULL intf_devnode) oops or panic the kernel, and the attacker can repeat failed registration to force the crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:02:24.621Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8b998c171ed875e402e1fd1c5cd619e4ca05e9c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3de14b4f681a1b3c6d375d98d9d37a55ebb85349"
        },
        {
          "url": "https://git.kernel.org/stable/c/8027f82c0f5474ed72448e160ee9778051fa1f49"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ac009a65d2385e9f0799eaf9d9694a29153a161"
        },
        {
          "url": "https://git.kernel.org/stable/c/712ca1cf756de2557a116e0df55791bac0c9f99e"
        },
        {
          "url": "https://git.kernel.org/stable/c/aad08b5f67d2a8116e1a00bce2611c1513b10bce"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce792b94e03882108019ba996c1a7c4d4e09be2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7600f5cee5de14065f950807931d6e6d40fb2d7"
        }
      ],
      "title": "Revert \"media: v4l2-dev: fix error handling in __video_register_device()\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89741",
    "datePublished": "2026-09-11T19:46:47.877Z",
    "dateReserved": "2026-09-11T19:38:34.761Z",
    "dateUpdated": "2026-09-14T12:02:24.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89741",
      "date": "2026-09-16",
      "epss": "0.00164",
      "percentile": "0.05989"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:50:35.000Z",
      "cve": "CVE-2026-89741",
      "id": "msrc_CVE-2026-89741",
      "initial_release_date": "2026-09-13T01:04:31.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Revert \"media: v4l2-dev: fix error handling in __video_register_device()\"",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89741.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89741\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:20:04.720\",\"lastModified\":\"2026-09-14T13:19:22.870\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRevert \\\"media: v4l2-dev: fix error handling in __video_register_device()\\\"\\n\\nThis reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a.\\n\\nThe intentions of that patch were good, but it doesn\u0027t work.\\n\\nThe idea is that if device_register fails, you have to do a put_device\\nto let the ref counter release resources.\\n\\nHowever, the V4L2 API says that if video_register_device() fails, then\\nyou have to call video_device_release(), which kfree()s the video_device\\nstruct.\\n\\nBut the put_device() will already have freed the struct, so you end\\nup in a double-free scenario.\\n\\nThere is not really a good way of fixing this without breaking\\nvideo_register_device() into two parts, one that initializes everything,\\nand one that does the actual device_register, and then converting all\\nV4L2 drivers to this new model.\\n\\nThat is a massive job, and it is very unlikely that device_register\\nwill fail.\\n\\nSo rather than ending up in a double-free scenario, just revert this\\npatch, and in that case we\u0027ll have a small memory leak. Which is a lot\\nmore robust.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/v4l2-core/v4l2-dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e5c8e62ae551e0ad2e15412aa0c57c2856d59677\",\"lessThan\":\"8b998c171ed875e402e1fd1c5cd619e4ca05e9c1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b451a9a46f2bfc510e6d5c2492df91647586184\",\"lessThan\":\"3de14b4f681a1b3c6d375d98d9d37a55ebb85349\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6be1f5633eae200af2527e9eeb7f51be5739b0f\",\"lessThan\":\"8027f82c0f5474ed72448e160ee9778051fa1f49\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae7b143e05b36fc69d6571751855946cc45064c6\",\"lessThan\":\"2ac009a65d2385e9f0799eaf9d9694a29153a161\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2429bb9fad88c8fa84c4956b0a21cf5afe5e92b7\",\"lessThan\":\"712ca1cf756de2557a116e0df55791bac0c9f99e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a934fdb01db6458288fc9386d3d8ceba6dd551a\",\"lessThan\":\"aad08b5f67d2a8116e1a00bce2611c1513b10bce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a934fdb01db6458288fc9386d3d8ceba6dd551a\",\"lessThan\":\"ce792b94e03882108019ba996c1a7c4d4e09be2c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a934fdb01db6458288fc9386d3d8ceba6dd551a\",\"lessThan\":\"e7600f5cee5de14065f950807931d6e6d40fb2d7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ee141706e701356dda41c6fed9ee18bf427c28e3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4451412739ed33a49b34624299394ee575116d0c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.239\",\"lessThan\":\"5.10.270\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.186\",\"lessThan\":\"5.15.221\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.142\",\"lessThan\":\"6.1.188\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.95\",\"lessThan\":\"6.6.157\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.35\",\"lessThan\":\"6.12.109\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.295\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.15.4\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/v4l2-core/v4l2-dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2ac009a65d2385e9f0799eaf9d9694a29153a161\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3de14b4f681a1b3c6d375d98d9d37a55ebb85349\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/712ca1cf756de2557a116e0df55791bac0c9f99e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8027f82c0f5474ed72448e160ee9778051fa1f49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8b998c171ed875e402e1fd1c5cd619e4ca05e9c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aad08b5f67d2a8116e1a00bce2611c1513b10bce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ce792b94e03882108019ba996c1a7c4d4e09be2c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e7600f5cee5de14065f950807931d6e6d40fb2d7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-16T14:15:15+00:00",
      "cve": "CVE-2026-89741",
      "id": "CVE-2026-89741",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "92",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Revert \"media: v4l2-dev: fix error handling in __video_register_device()\"",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89741.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.