Executive brief
The Linux kernel's OV02A10 camera sensor driver contains a use-after-free vulnerability in its hardware configuration parsing function. An attacker with access to device firmware configuration could trigger a kernel memory safety violation, potentially leading to denial of service or privilege escalation on systems with this driver enabled.
Technical details
The vulnerability exists in the ov02a10_check_hwcfg() function within drivers/media/i2c/ov02a10.c. The function prematurely frees an endpoint handle via fwnode_handle_put(ep) and then attempts to read properties from that freed handle using fwnode_property_read_u32(), creating a classic use-after-free. Additionally, the code incorrectly assigns the return value of fwnode_property_read_u32() to a shared 'ret' variable, causing a missing optional property to incorrectly fail the entire probe. The fix reorders operations to read the optional 'ovti,mipi-clock-voltage' property before freeing the endpoint handle and avoids overwriting the 'ret' variable with optional property read failures. No authentication or network access is required; the vulnerability can be triggered via specially crafted device firmware.
Affected products
- Linux Linux kernel 5.0 and later (prior to fix in commit 94971ba0592ca77ec99b292226a4b398763315b8)
Timeline
- 2026-09-16: disclosed: CVE-2026-89888 published
- 2026-07-08: patched: Fix committed upstream by Biren Pandya
- 2026-09-14: patched: Fix merged into stable kernel trees