media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
In the Linux kernel, the following vulnerability has been resolved: media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref airspy_disconnect() clears s->udev under v4l2_lock, but airspy_stop_streaming() unconditionally calls airspy_ctrl_msg() and airspy_free_stream_bufs() afterwards. If a streaming user closes the device after disconnect, stop_streaming() runs and dereferences the NULL s->udev: airspy_stop_streaming() airspy_ctrl_msg(s, CMD_RECEIVER_MODE, 0, 0, NULL, 0) usb_sndctrlpipe(s->udev, 0) /* NULL deref */ airspy_free_stream_bufs(s) usb_free_coherent(s->udev, ...) /* NULL deref */ The airspy driver uses vb2_fop_release() in its file_operations, so replace video_unregister_device(&s->vdev) with vb2_video_unregister_device(&s->vdev) and move it before clearing s->udev. vb2_video_unregister_device() releases the vb2 queue, which synchronously runs airspy_stop_streaming() if streaming is active, so the URBs, coherent DMA stream buffers and the hardware stop control message all execute while s->udev is still valid. vb2_video_unregister_device() locks vdev->queue->lock (vb_queue_lock) internally, and stop_streaming() locks v4l2_lock, so the previous outer mutex_lock(&s->vb_queue_lock) / mutex_lock(&s->v4l2_lock) pair around the unregister sequence would self-deadlock and has been removed. A short v4l2_lock critical section around s->udev = NULL remains so any ioctl path that still holds the file descriptor sees coherent state. Issue identified by a
CVE-2026-89901
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-89901
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "634fe5033951b80ef4b98d8f047cb1083d29170d",
"lessThan": "c9081e2655188d2d134a741aec837dc70439d505",
"versionType": "git"
},
{
"status": "affected",
"version": "634fe5033951b80ef4b98d8f047cb1083d29170d",
"lessThan": "75089cea32e5055773bd13116236d08fdc98678a",
"versionType": "git"
},
{
"status": "affected",
"version": "634fe5033951b80ef4b98d8f047cb1083d29170d",
"lessThan": "155d0378ae0d6305cc4840583a6b42d2d0595bff",
"versionType": "git"
},
{
"status": "affected",
"version": "634fe5033951b80ef4b98d8f047cb1083d29170d",
"lessThan": "6e4ea90fdc6608cd5fac342e146ab6ae15d430bc",
"versionType": "git"
},
{
"status": "affected",
"version": "634fe5033951b80ef4b98d8f047cb1083d29170d",
"lessThan": "a9a8c37ddda9fa3687b142be9098e1c37b8faf35",
"versionType": "git"
},
{
"status": "affected",
"version": "634fe5033951b80ef4b98d8f047cb1083d29170d",
"lessThan": "297fee023f46d771a844520675692ea089d80d9d",
"versionType": "git"
},
{
"status": "affected",
"version": "634fe5033951b80ef4b98d8f047cb1083d29170d",
"lessThan": "c6749ac8f59cc80eb1b2d52f167fdf13e12655cc",
"versionType": "git"
},
{
"status": "affected",
"version": "634fe5033951b80ef4b98d8f047cb1083d29170d",
"lessThan": "2f378dc45e685fc825d2dd08e7864666d6fcc009",
"versionType": "git"
}
],
"programFiles": [
"drivers/media/usb/airspy/airspy.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/media/usb/airspy/airspy.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-89901
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #36349 · Revision 1
- Added to Heist Feed
- Publisher date