Executive brief
The Linux kernel's USB Video Class (UVC) gadget driver contains a use-after-free vulnerability in the device initialization and cleanup code paths. An attacker with the ability to trigger device binding or unbinding operations could cause a kernel crash or potentially execute arbitrary code, disrupting video streaming devices or gaining kernel-level access.
Technical details
The vulnerability is a use-after-free (UAF) in the USB gadget UVC (Video Class) function driver, specifically in the uvc_function_bind() error path and uvc_function_unbind() cleanup function in drivers/usb/gadget/function/f_uvc.c. After freeing memory (uvc->control_req via usb_ep_free_request() and uvc->control_buf via kfree()), the pointers were not nullified, leaving dangling pointers that could be dereferenced on subsequent operations. The vulnerability requires local kernel execution context (gadget device binding/unbinding), but once triggered during error conditions or device removal, the freed memory may be reallocated and dereferenced, enabling information disclosure or code execution. The fix sets freed pointers to NULL immediately after deallocation to prevent reuse.
Affected products
- Linux Linux kernel multiple versions (broadly distributed across 2.6.11 through 7.2+)
Timeline
- 2026-09-11: disclosed: CVE-2026-89733 published
- 2026-08-13: patched: Patch committed by Jeffin Philip
- 2026-09-07: patched: Patch merged to stable kernel tree