Linux Distros Unpatched Vulnerability : CVE-2026-89733

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: uvc: fix dangling pointers in uvcfunctionbind and uvcfunctionunbind In uvcfunctionbind error path, we use usbepfreerequest which uses uvc-controlre...

CVE-2026-89734

A flaw was found in the Linux kernel's USB Video Class UVC gadget driver. This vulnerability occurs in the uvcgvideoinit function when the kthreadrunworker function fails. In such a scenario, an error logging mechanism attempts to access an uninitialized pointer, leading to a null pointer...

CVE-2026-89733

A flaw was found in the Linux kernel's USB Video Class UVC gadget driver. This vulnerability occurs in the uvcfunctionbind and uvcfunctionunbind functions, where pointers to freed memory are not properly cleared. This can lead to a use-after-free UAF condition, potentially allowing an attacker to...

DEBIAN-CVE-2026-89733

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvcfunctionbind and uvcfunctionunbind In uvcfunctionbind error path, we use usbepfreerequest which uses uvc-controlreq but does not set it to NULL afterwards. Thus, uvc-controlreq is a...

CVE-2026-89733

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvcfunctionbind and uvcfunctionunbind In uvcfunctionbind error path, we use usbepfreerequest which uses uvc-controlreq but does not set it to NULL afterwards. Thus, uvc-controlreq is a...

AZL-100431 CVE-2026-89733 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvcfunctionbind and uvcfunctionunbind In uvcfunctionbind error path, we use usbepfreerequest which uses uvc-controlreq but does not set it to NULL afterwards. Thus, uvc-controlreq is a...

CVE-2026-89734

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit In uvcgvideoinit, if kthreadrunworker fails, the error logged uses uvcgerr, however, the pointer it uses: video-uvc is not assigned at this point, triggering a null...

CVE-2026-89734 usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit In uvcgvideoinit, if kthreadrunworker fails, the error logged uses uvcgerr, however, the pointer it uses: video-uvc is not assigned at this point, triggering a null...

CVE-2026-89734 usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit In uvcgvideoinit, if kthreadrunworker fails, the error logged uses uvcgerr, however, the pointer it uses: video-uvc is not assigned at this point, triggering a null...

EUVD-2026-76646

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit In uvcgvideoinit, if kthreadrunworker fails, the error logged uses uvcgerr, however, the pointer it uses: video-uvc is not assigned at this point, triggering a null...

CVE-2026-89734

CVE-2026-89734 is a null pointer dereference in the Linux kernel's USB gadget UVC driver. In the function uvcg_video_init(), if kthread_run_worker() fails, the error-handling path invokes uvcg_err(), which dereferences video->uvc. However, at that point in initialization the pointer has not ye...

CVE-2026-89733

A use-after-free (UAF) vulnerability exists in the Linux kernel USB gadget UVC driver . In the error path of uvc_function_bind() and in uvc_function_unbind(), the pointers uvc->control_req and uvc->control_buf are freed but not set to NULL , leaving dangling pointers that can be dereference...

CVE-2026-89733

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvcfunctionbind and uvcfunctionunbind In uvcfunctionbind error path, we use usbepfreerequest which uses uvc-controlreq but does not set it to NULL afterwards. Thus, uvc-controlreq is a...

EUVD-2026-76645

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvcfunctionbind and uvcfunctionunbind In uvcfunctionbind error path, we use usbepfreerequest which uses uvc-controlreq but does not set it to NULL afterwards. Thus, uvc-controlreq is a...

CVE-2026-89733 usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvcfunctionbind and uvcfunctionunbind In uvcfunctionbind error path, we use usbepfreerequest which uses uvc-controlreq but does not set it to NULL afterwards. Thus, uvc-controlreq is a...

CVE-2026-89733 usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvcfunctionbind and uvcfunctionunbind In uvcfunctionbind error path, we use usbepfreerequest which uses uvc-controlreq but does not set it to NULL afterwards. Thus, uvc-controlreq is a...

PT-2026-90449

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvc function bind and uvc function unbind In uvc function bind error path, we use usb ep free request which uses uvc-control req but does not set it to NULL afterwards. Thus, uvc-control...

PT-2026-90450

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcg video init In uvcg video init, if kthread run worker fails, the error logged uses uvcg err, however, the pointer it uses: video-uvc is not assigned at this point, triggering ...

kernel-c-to-rust-spike

Kernel C-to-Rust hardening spike: UVC descriptor parser Can a security-critical Linux kernel C parser be hardened by rewriting it in Rust, with the rewrite shown equivalent to the original and then formally verified? This spike runs the full loop on one target: the UVC video descriptor parser...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: USB: Gadget: UVC: Prevent buffer overflow in setup handler The uvcfunctionsetup function allows control transfers with a payload of up to 64 bytes UVCMAXREQUESTSIZE. The data stage handler for OUT transfers uses memcpy to copy th...