EUVD-2026-80501

In the Linux kernel, the following vulnerability has been resolved: media: airspy: use vb2videounregisterdevice on disconnect to fix NULL deref airspydisconnect clears s-udev under v4l2lock, but airspystopstreaming unconditionally calls airspyctrlmsg and airspyfreestreambufs afterwards. If a...

CVE-2026-89901 media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref

In the Linux kernel, the following vulnerability has been resolved: media: airspy: use vb2videounregisterdevice on disconnect to fix NULL deref airspydisconnect clears s-udev under v4l2lock, but airspystopstreaming unconditionally calls airspyctrlmsg and airspyfreestreambufs afterwards. If a...

CVE-2026-89901

In the Linux kernel, the following vulnerability has been resolved: media: airspy: use vb2videounregisterdevice on disconnect to fix NULL deref airspydisconnect clears s-udev under v4l2lock, but airspystopstreaming unconditionally calls airspyctrlmsg and airspyfreestreambufs afterwards. If a...

CVE-2026-89901 media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref

In the Linux kernel, the following vulnerability has been resolved: media: airspy: use vb2videounregisterdevice on disconnect to fix NULL deref airspydisconnect clears s-udev under v4l2lock, but airspystopstreaming unconditionally calls airspyctrlmsg and airspyfreestreambufs afterwards. If a...

CVE-2026-89901

CVE-2026-89901 is a NULL pointer dereference in the Linux kernel's airspy USB media driver. The root cause is a race between airspy_disconnect() (which clears s->udev) and airspy_stop_streaming() (which unconditionally calls airspy_ctrl_msg() and airspy_free_stream_bufs()). If a streaming user...

CVE-2026-89890 media: go7007: defer the ALSA v4l2 put until card release

In the Linux kernel, the following vulnerability has been resolved: media: go7007: defer the ALSA v4l2 put until card release go7007sndinit already takes a v4l2device reference for the ALSA side, but go7007sndremove drops it immediately after calling sndcardfreewhenclosed. That is too early when ...

CVE-2026-89890

CVE-2026-89890 is a use-after-free in the Linux kernel's go7007 media driver. In go7007_snd_remove(), the v4l2_device reference is dropped immediately after snd_card_free_when_closed(), which is too early when a userspace process still has the capture PCM open. The ALSA card's PCM callbacks remai...

CVE-2026-89890 media: go7007: defer the ALSA v4l2 put until card release

In the Linux kernel, the following vulnerability has been resolved: media: go7007: defer the ALSA v4l2 put until card release go7007sndinit already takes a v4l2device reference for the ALSA side, but go7007sndremove drops it immediately after calling sndcardfreewhenclosed. That is too early when ...

EUVD-2026-80490

In the Linux kernel, the following vulnerability has been resolved: media: go7007: defer the ALSA v4l2 put until card release go7007sndinit already takes a v4l2device reference for the ALSA side, but go7007sndremove drops it immediately after calling sndcardfreewhenclosed. That is too early when ...

CVE-2026-89890

In the Linux kernel, the following vulnerability has been resolved: media: go7007: defer the ALSA v4l2 put until card release go7007sndinit already takes a v4l2device reference for the ALSA side, but go7007sndremove drops it immediately after calling sndcardfreewhenclosed. That is too early when ...

CVE-2026-89881 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: use vb2videounregisterdevice on remove to fix DMA leak rtl2832sdrremove runs on USB disconnect and clears dev-udev to NULL before any pending streaming teardown has run. When user space later closes its file...

CVE-2026-89881

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: use vb2videounregisterdevice on remove to fix DMA leak rtl2832sdrremove runs on USB disconnect and clears dev-udev to NULL before any pending streaming teardown has run. When user space later closes its file...

EUVD-2026-80481

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: use vb2videounregisterdevice on remove to fix DMA leak rtl2832sdrremove runs on USB disconnect and clears dev-udev to NULL before any pending streaming teardown has run. When user space later closes its file...

CVE-2026-89881 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: use vb2videounregisterdevice on remove to fix DMA leak rtl2832sdrremove runs on USB disconnect and clears dev-udev to NULL before any pending streaming teardown has run. When user space later closes its file...

CVE-2026-89881

This CVE affects the rtl2832_sdr media driver in the Linux kernel . On USB disconnect, rtl2832_sdr_remove() clears dev->udev to NULL before any pending streaming teardown has completed. When user space subsequently closes its file descriptor, usb_free_coherent() is invoked with a NULL device p...

CVE-2026-89878

In the Linux kernel, the following vulnerability has been resolved: media: s2255: check firmware size before reading trailing marker s2255probe reads a 4-byte marker and version from the last 8 bytes of the firmware blob fw-datafwsize - 8 and fwsize - 4. If the firmware file is shorter than 8...

EUVD-2026-80478

In the Linux kernel, the following vulnerability has been resolved: media: s2255: check firmware size before reading trailing marker s2255probe reads a 4-byte marker and version from the last 8 bytes of the firmware blob fw-datafwsize - 8 and fwsize - 4. If the firmware file is shorter than 8...

CVE-2026-89878

CVE-2026-89878 affects the Linux kernel media: s2255 driver. In s2255_probe(), the function reads a 4-byte marker and version from the last 8 bytes of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the firmware file is shorter than 8 bytes, fw_size - 8 underflows , causing an ...

CVE-2026-89878 media: s2255: check firmware size before reading trailing marker

In the Linux kernel, the following vulnerability has been resolved: media: s2255: check firmware size before reading trailing marker s2255probe reads a 4-byte marker and version from the last 8 bytes of the firmware blob fw-datafwsize - 8 and fwsize - 4. If the firmware file is shorter than 8...

CVE-2026-89878 media: s2255: check firmware size before reading trailing marker

In the Linux kernel, the following vulnerability has been resolved: media: s2255: check firmware size before reading trailing marker s2255probe reads a 4-byte marker and version from the last 8 bytes of the firmware blob fw-datafwsize - 8 and fwsize - 4. If the firmware file is shorter than 8...