From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-89871: media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
Date: Wed, 16 Sep 2026 11:30:01 +0100 [thread overview]
Message-ID: <2026091626-CVE-2026-89871-e2aa@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
kthread_run() returns an ERR_PTR on failure, not NULL.
When start_streaming() fails, data->kthread_vid_cap is left holding
this error pointer instead of being cleared.
This causes two subsequent bugs:
1. A future call to start_streaming() sees a non-NULL kthread_vid_cap
and returns 0 (success) immediately, without actually starting the
capture thread.
2. A call to stop_streaming() checks 'kthread_vid_cap == NULL' which
is false for an error pointer, and proceeds to call kthread_stop()
on the error pointer, leading to a kernel crash.
Fix this by resetting kthread_vid_cap to NULL on failure before
jumping to the error path.
The Linux kernel CVE team has assigned CVE-2026-89871 to this issue.
Affected and fixed versions
===========================
Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 5.10.270 with commit db0f4531aa55cfb0171684ebfffe3ff04b79d5a8
Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 5.15.221 with commit 0fac63cac6689588da530764ccb6ba55ee8e4d8b
Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 6.1.188 with commit 5c35d380bea60503c4fe0986fe1de6a3263282b3
Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 6.6.157 with commit 3d1b10d81fe54852ed953f4129577b733bbd6907
Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 6.12.110 with commit 968c5213e34c48d35febdfd09cf3dc58ad039140
Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 6.18.51 with commit 52fd9d80c0cea7bf09e7ee36cad316e5c39b7fe6
Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 7.2.5 with commit 0e7f2cd72a4f9268ee09a13b13f3339e7cc71557
Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 7.3-rc1 with commit 76e379754ba618989f6215be608d5c04774a611d
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-89871
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/media/i2c/video-i2c.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/db0f4531aa55cfb0171684ebfffe3ff04b79d5a8
https://git.kernel.org/stable/c/0fac63cac6689588da530764ccb6ba55ee8e4d8b
https://git.kernel.org/stable/c/5c35d380bea60503c4fe0986fe1de6a3263282b3
https://git.kernel.org/stable/c/3d1b10d81fe54852ed953f4129577b733bbd6907
https://git.kernel.org/stable/c/968c5213e34c48d35febdfd09cf3dc58ad039140
https://git.kernel.org/stable/c/52fd9d80c0cea7bf09e7ee36cad316e5c39b7fe6
https://git.kernel.org/stable/c/0e7f2cd72a4f9268ee09a13b13f3339e7cc71557
https://git.kernel.org/stable/c/76e379754ba618989f6215be608d5c04774a611d
reply other threads:[~2026-09-16 10:36 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026091626-CVE-2026-89871-e2aa@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.