Executive brief
The em28xx USB media driver has a use-after-free vulnerability in how it registers audio extensions on dual-tuner devices. When a secondary device is freed during disconnect, a pointer to it can still be accessed by extension callbacks, potentially causing system crashes or instability. This affects systems with dual-tuner em28xx capture boards.
Technical details
A use-after-free vulnerability exists in the em28xx driver's extension registration logic. The audio-only code path registers extensions during probe of the primary device, before a secondary device (dev_next) is created on dual-TS boards. The secondary device inherits the is_audio_only flag and is independently inserted into em28xx_devlist, violating the design assumption that only primary devices appear in the list. When the secondary device is freed during disconnect, its list node remains reachable, leading to use-after-free when extension callbacks attempt to access it. The fix defers audio-only extension registration to the module-request work queue, ensuring it runs only after secondary device construction completes. Attack vector requires local access (USB device connection), and the vulnerability manifests as potential memory corruption or system crash rather than privilege escalation.
Affected products
- Linux Linux kernel all versions with em28xx driver (patched in various stable branches, original fix commit 95f76f51937fdfb0fc1e14cae606b1ef574a56f3)
Timeline
- 2026-07-23: other: Vulnerability reported by syzbot
- 2026-09-14: patched: Fix committed to stable kernel branches
- 2026-09-16: disclosed: CVE-2026-89892 published