CVE-2026-89898

CVE-2026-89898 affects the Linux kernel 's CEC (Consumer Electronics Control) media driver for the Extron DA HD 4K Plus device. The root cause is a missing sanity check that allows an overflow of the msg.msg[] buffer when malformed incoming data is processed. The CVSS 3.1 score is 8.8 (HIGH) with...

CVE-2026-89896

This Linux kernel memory leak affects the cedrus media driver (Allwinner SoC VPU). In cedrus_init_ctrls() , the V4L2 control handler is initialized before allocating memory for ctx->ctrls; if that allocation fails, the function returns -ENOMEM without freeing the handler resources, causing a l...

CVE-2026-89894

CVE-2026-89894 is a heap out-of-bounds write in the Linux kernel cx231xx media driver. The vulnerability arises because vidioc_s_fmt_vid_cap() and vidioc_s_std() can change the device-wide geometry (dev->width/dev->norm) while only checking whether the video queue is busy, not the VBI queue...

CVE-2026-89895

CVE-2026-89895 is a double-free vulnerability in the Linux kernel's cobalt media driver (ALSA subsystem). The root cause lies in the error-handling path of cobalt_alsa_init(): after snd_cobalt_card_create() stores the cobsc object in sc->private_data, a failure later in initialization triggers...

CVE-2026-89893

CVE-2026-89893 is a use-after-free vulnerability in the Linux kernel's media/cx23885 driver, specifically in the NetUP CI (Common Interface) path. During device removal, cx23885_finidev() calls free_irq() before the CI device is unregistered. Because free_irq() does not drain work items previousl...

CVE-2026-89892

CVE-2026-89892 is a use-after-free in the Linux kernel's em28xx media driver. On dual-TS boards , the audio-only path registers extensions during primary device probing, before the secondary device (dev_next) is created. The duplicate device inherits is_audio_only and is independently inserted in...

CVE-2026-89890

CVE-2026-89890 is a use-after-free in the Linux kernel's go7007 media driver. In go7007_snd_remove(), the v4l2_device reference is dropped immediately after snd_card_free_when_closed(), which is too early when a userspace process still has the capture PCM open. The ALSA card's PCM callbacks remai...

CVE-2026-89891

CVE-2026-89891 is a use-after-free vulnerability in the Linux kernel's em28xx media driver. When a device with has_dual_ts=1 takes the is_audio_only probe path, both dev and dev->dev_next are added to the global em28xx_devlist. On disconnect, em28xx_close_extension() only unlinks dev->devli...

CVE-2026-89889

CVE-2026-89889 is a bug in the Linux kernel's imx415 I2C media (camera sensor) driver. In the VBLANK handling path, when programming VMAX failed after pm_runtime_get_if_in_use() had taken a runtime PM reference , the code returned immediately without calling pm_runtime_put(), leaking the referenc...

CVE-2026-89887

CVE-2026-89887 is a use-after-destroy and double-free bug in the Linux kernel's ov7740 I2C media (camera sensor) driver . The ov7740_remove() function destroyed the driver's mutex before freeing the V4L2 control handler that relies on it, causing a kernel panic . Additionally, v4l2_ctrl_handler_f...

CVE-2026-89888

CVE-2026-89888 affects the Linux kernel driver media/i2c/ov02a10 (a camera sensor driver). The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep) to free the endpoint handle, then subsequently calls fwnode_property_read_u32() on the same freed handle, resulting in a use-after-free . A sec...

CVE-2026-89886

CVE-2026-89886 affects the Linux kernel intel/ipu6 media driver. In isys_notifier_init() , after calling v4l2_async_nf_init() and beginning to add fwnode remote subdevs via v4l2_async_nf_add_fwnode_remote(), an endpoint parse or add failure mid-loop jumps to err_parse and returns without calling ...

CVE-2026-89885

CVE-2026-89885 is a use-after-free vulnerability in the Linux kernel 's mtk-mdp3 media platform driver. In mdp_probe(), when the primary scp_get() call fails, the fallback path retrieves the SCP platform device via __get_pdev_by_id() but immediately drops the reference after reading driver data. ...

CVE-2026-89884

CVE-2026-89884 affects the mtk-mdp3 platform driver in the Linux kernel (MediaTek multimedia display processor). The vulnerability is a NULL pointer dereference that occurs when the driver looks up the SCP (System Control Processor) but the SCP driver has not yet been bound, causing the lookup to...

CVE-2026-89883

This vulnerability affects the Linux kernel 's sunxi-cir infrared remote control driver (used in Allwinner/Sunxi SoCs). The root cause is an improper error-handling path: after rc_register_device() succeeds, subsequent probe failures (IRQ lookup, IRQ request, or hardware initialization) jump to a...

CVE-2026-89882

CVE-2026-89882 is an out-of-bounds read in the Linux kernel's RKVDEC HEVC video decoder (media: rkvdec: hevc). The function st_ref_pic_set_prediction() computes a reference RPS index using two u8 operands; when delta_idx_minus1 + 1 exceeds the current index, the subtraction underflows , causing a...

CVE-2026-89880

CVE-2026-89880 affects the Linux kernel rtl2832_sdr media driver (Realtek RTL2832 USB SDR radio). The root cause is a missing teardown on the error path of rtl2832_sdr_start_streaming(): when URB submission or allocation fails after stream buffers are allocated, the URBs and coherent DMA buffers ...

CVE-2026-89881

This CVE affects the rtl2832_sdr media driver in the Linux kernel . On USB disconnect, rtl2832_sdr_remove() clears dev->udev to NULL before any pending streaming teardown has completed. When user space subsequently closes its file descriptor, usb_free_coherent() is invoked with a NULL device p...

CVE-2026-89879

This Linux kernel vulnerability affects the s2255 media driver. In s2255_fillbuff(), a memcpy() copies vc->jpg_size bytes of a captured JPEG/MJPEG frame into a vb2 plane, but the size value is taken verbatim from the device's S2255_MARKER_FRAME header without being bounded against the destinat...

CVE-2026-89878

CVE-2026-89878 affects the Linux kernel media: s2255 driver. In s2255_probe(), the function reads a 4-byte marker and version from the last 8 bytes of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the firmware file is shorter than 8 bytes, fw_size - 8 underflows , causing an ...