CVE-2026-89889

CVE-2026-89889 is a bug in the Linux kernel's imx415 I2C media (camera sensor) driver. In the VBLANK handling path, when programming VMAX failed after pm_runtime_get_if_in_use() had taken a runtime PM reference , the code returned immediately without calling pm_runtime_put(), leaking the referenc...

CVE-2026-89887

CVE-2026-89887 is a use-after-destroy and double-free bug in the Linux kernel's ov7740 I2C media (camera sensor) driver . The ov7740_remove() function destroyed the driver's mutex before freeing the V4L2 control handler that relies on it, causing a kernel panic . Additionally, v4l2_ctrl_handler_f...

CVE-2026-89888

CVE-2026-89888 affects the Linux kernel driver media/i2c/ov02a10 (a camera sensor driver). The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep) to free the endpoint handle, then subsequently calls fwnode_property_read_u32() on the same freed handle, resulting in a use-after-free . A sec...

CVE-2026-89886

CVE-2026-89886 affects the Linux kernel intel/ipu6 media driver. In isys_notifier_init() , after calling v4l2_async_nf_init() and beginning to add fwnode remote subdevs via v4l2_async_nf_add_fwnode_remote(), an endpoint parse or add failure mid-loop jumps to err_parse and returns without calling ...

CVE-2026-89885

CVE-2026-89885 is a use-after-free vulnerability in the Linux kernel 's mtk-mdp3 media platform driver. In mdp_probe(), when the primary scp_get() call fails, the fallback path retrieves the SCP platform device via __get_pdev_by_id() but immediately drops the reference after reading driver data. ...

CVE-2026-89884

CVE-2026-89884 affects the mtk-mdp3 platform driver in the Linux kernel (MediaTek multimedia display processor). The vulnerability is a NULL pointer dereference that occurs when the driver looks up the SCP (System Control Processor) but the SCP driver has not yet been bound, causing the lookup to...

CVE-2026-89883

This vulnerability affects the Linux kernel 's sunxi-cir infrared remote control driver (used in Allwinner/Sunxi SoCs). The root cause is an improper error-handling path: after rc_register_device() succeeds, subsequent probe failures (IRQ lookup, IRQ request, or hardware initialization) jump to a...

CVE-2026-89882

CVE-2026-89882 is an out-of-bounds read in the Linux kernel's RKVDEC HEVC video decoder (media: rkvdec: hevc). The function st_ref_pic_set_prediction() computes a reference RPS index using two u8 operands; when delta_idx_minus1 + 1 exceeds the current index, the subtraction underflows , causing a...

CVE-2026-89881

This CVE affects the rtl2832_sdr media driver in the Linux kernel . On USB disconnect, rtl2832_sdr_remove() clears dev->udev to NULL before any pending streaming teardown has completed. When user space subsequently closes its file descriptor, usb_free_coherent() is invoked with a NULL device p...

CVE-2026-89880

CVE-2026-89880 affects the Linux kernel rtl2832_sdr media driver (Realtek RTL2832 USB SDR radio). The root cause is a missing teardown on the error path of rtl2832_sdr_start_streaming(): when URB submission or allocation fails after stream buffers are allocated, the URBs and coherent DMA buffers ...

CVE-2026-89879

This Linux kernel vulnerability affects the s2255 media driver. In s2255_fillbuff(), a memcpy() copies vc->jpg_size bytes of a captured JPEG/MJPEG frame into a vb2 plane, but the size value is taken verbatim from the device's S2255_MARKER_FRAME header without being bounded against the destinat...

CVE-2026-89878

CVE-2026-89878 affects the Linux kernel media: s2255 driver. In s2255_probe(), the function reads a 4-byte marker and version from the last 8 bytes of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the firmware file is shorter than 8 bytes, fw_size - 8 underflows , causing an ...

CVE-2026-89877

CVE-2026-89877 affects the saa7164 media driver in the Linux kernel . The root cause is a cleanup bug in saa7164_dev_setup(): the device is added to the global saa7164_devlist before PCI BAR memory regions are requested. If get_resources() fails, the device remains on the list while the probe err...

CVE-2026-89876

CVE-2026-89876 affects the tda18250 driver in the Linux kernel's media subsystem. The vulnerability is a possible integer overflow that occurs when the variable exp equals zero, causing the expression 1 <

CVE-2026-89875

This is a use-after-free vulnerability in the Linux kernel's Texas Instruments VIP (Video Imaging Processors) driver, specifically the vpe media subsystem. The root cause is that vip_stop_streaming() masks and clears per-list IRQs but does not synchronize the hardirq handler or disable the recove...

CVE-2026-89874

CVE-2026-89874 affects the Linux kernel media subsystem (v4l2-async). The vulnerability is a NULL pointer dereference in v4l2_async_match_notify(): when ancillary media link creation fails, the function jumps to err_call_unbind before asc_subdev_entry is inserted into sd->asc_list. Because asy...

CVE-2026-89873

CVE-2026-89873 affects the Linux kernel 's media: v4l2-ctrls subsystem, which handles HEVC video decoding controls. The vulnerability is a missing input validation on the HEVC Sequence Parameter Set (SPS) Reference Picture Set (RPS) counts. Specifically, SPS values exceeding the HEVC limits of 64...

CVE-2026-89872

CVE-2026-89872 affects the Linux kernel in the v4l2-fwnode media subsystem. The root cause is a fwnode reference leak in v4l2_fwnode_parse_link(): the remote endpoint fwnode handle acquired via fwnode_graph_get_remote_endpoint() is properly released on error paths but is not released on the succe...

CVE-2026-89871

CVE-2026-89871 affects the Linux kernel in the media: video-i2c subsystem. The root cause is that kthread_run() returns an ERR_PTR on failure (not NULL), and when start_streaming() fails, the data->kthread_vid_cap field is left holding this error pointer instead of being reset. This leads to t...

CVE-2026-89870

CVE-2026-89870 is a double-free vulnerability in the Linux kernel 's zoran media driver. During device teardown, zoran_exit_video_devices() called video_unregister_device() (which eventually triggers the V4L2 core's release callback to free the video_device) and then explicitly called kfree(zr-&g...