From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7131A4F7987 for ; Wed, 16 Sep 2026 10:36:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555019; cv=none; b=nUJc2kYyeMt3N4hKAm6fJ4alu9ymx86LFXAfE8liDGTbxJiH1G+1YLnh6c76CsxutUxYArLhF1UyMZQYTHKAtBVs3Fehbr7mVojxA+asQkPAQ4B0GigdlgzycYUgKu7vrVQZo2pU9TqujWrGskdpl7XBb5tmpLOyIPdwmmkvX2Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555019; c=relaxed/simple; bh=tzdD5TWQwFXpph9EnzkzpOpqWHSEviX2n1wa/1DDzZI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=GMlC2i7PenkBtygpto5+NS2sWmUDxyAm0TSm+z1bWvAhz/YQ/gdPbHLf0dE/tFa9QOxxK+ImOXFKF9nPdKmoLm8VR1GNfISLbQiojFQOkYZNPaPMkaeUkTWB4NTI3oYLcyUQmCPinZL6sIs5MD3C5rlxTJgcUudaKvmzf41dYuU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=G9erKYSw; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="G9erKYSw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DA49F1F00898; Wed, 16 Sep 2026 10:36:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789554995; bh=uPgfBWsaY51lD+7FXwa2rDrH5BOCEJU51HjIOm6aMNM=; h=From:To:Cc:Subject:Date:Reply-To; b=G9erKYSwNwspRsqDC3qLPK/oal5bFW9i56xKPOmFqxXR9qh8VP60PKk0He58SSecH k98YKEiJ2UJIGDW2sRDx+vGa1EFxTpjouacTEj3Az6xXECqF5qLEL8ByPZXnsMQSLl zUXW0P9Yd4F6BGxbWhi55yY9UglCkuY5p4YdWK8g= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89871: media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure Date: Wed, 16 Sep 2026 11:30:01 +0100 Message-ID: <2026091626-CVE-2026-89871-e2aa@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3826; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=bGBG21TRyvNiYzfQgq4juosyq10wHnzjJ1tWgrlBZVU=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmr8tvK7p3b6Orop/HuY/kpvrhWptaZ119aHrB1P9azI DGDqfxrRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzE4TzDgj5BXiWOmTf+P1dx 3rGvOu/58wdZkxnmqW1M2ZyudD/lmHsSy+Svdx0DpX7/AwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure kthread_run() returns an ERR_PTR on failure, not NULL. When start_streaming() fails, data->kthread_vid_cap is left holding this error pointer instead of being cleared. This causes two subsequent bugs: 1. A future call to start_streaming() sees a non-NULL kthread_vid_cap and returns 0 (success) immediately, without actually starting the capture thread. 2. A call to stop_streaming() checks 'kthread_vid_cap == NULL' which is false for an error pointer, and proceeds to call kthread_stop() on the error pointer, leading to a kernel crash. Fix this by resetting kthread_vid_cap to NULL on failure before jumping to the error path. The Linux kernel CVE team has assigned CVE-2026-89871 to this issue. Affected and fixed versions =========================== Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 5.10.270 with commit db0f4531aa55cfb0171684ebfffe3ff04b79d5a8 Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 5.15.221 with commit 0fac63cac6689588da530764ccb6ba55ee8e4d8b Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 6.1.188 with commit 5c35d380bea60503c4fe0986fe1de6a3263282b3 Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 6.6.157 with commit 3d1b10d81fe54852ed953f4129577b733bbd6907 Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 6.12.110 with commit 968c5213e34c48d35febdfd09cf3dc58ad039140 Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 6.18.51 with commit 52fd9d80c0cea7bf09e7ee36cad316e5c39b7fe6 Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 7.2.5 with commit 0e7f2cd72a4f9268ee09a13b13f3339e7cc71557 Issue introduced in 4.18 with commit 5cebaac609744414463d1ecc28fdecd26c1b9bc1 and fixed in 7.3-rc1 with commit 76e379754ba618989f6215be608d5c04774a611d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89871 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/media/i2c/video-i2c.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/db0f4531aa55cfb0171684ebfffe3ff04b79d5a8 https://git.kernel.org/stable/c/0fac63cac6689588da530764ccb6ba55ee8e4d8b https://git.kernel.org/stable/c/5c35d380bea60503c4fe0986fe1de6a3263282b3 https://git.kernel.org/stable/c/3d1b10d81fe54852ed953f4129577b733bbd6907 https://git.kernel.org/stable/c/968c5213e34c48d35febdfd09cf3dc58ad039140 https://git.kernel.org/stable/c/52fd9d80c0cea7bf09e7ee36cad316e5c39b7fe6 https://git.kernel.org/stable/c/0e7f2cd72a4f9268ee09a13b13f3339e7cc71557 https://git.kernel.org/stable/c/76e379754ba618989f6215be608d5c04774a611d