{"id":"CVE-2026-89888","published":"2026-09-16T11:16:57.347","lastModified":"2026-09-16T15:18:15.367","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ov02a10: fix endpoint parsing use-after-free\n\nThe ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)\nimmediately after allocating and parsing the endpoint. However, it\nsubsequently calls fwnode_property_read_u32() using the same 'ep'\nhandle, leading to a potential use-after-free.\n\nAdditionally, reading the optional 'ovti,mipi-clock-voltage' property\nused to overwrite the 'ret' variable. If the property was missing,\n'ret' would become negative, and this failure code would be incorrectly\nreturned at the end of the function, causing probe to fail entirely.\n\nFix the use-after-free by moving fwnode_property_read_u32() before\nthe endpoint is parsed and freed. Avoid the error leak by not\nassigning the result of fwnode_property_read_u32() to 'ret'.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/213b2489130357c8d3e8d4fb2bdab88791ce3185","tags":[]},{"url":"https://git.kernel.org/stable/c/4c2988bf1ad2753240a38db10ce23e87ec542f8f","tags":[]},{"url":"https://git.kernel.org/stable/c/6e13784452785cd8402b228bea53bc6a027ade84","tags":[]},{"url":"https://git.kernel.org/stable/c/8ddb3b69f67b0632ff3830da18de3e8dcaf5884b","tags":[]},{"url":"https://git.kernel.org/stable/c/90f9b421fc6d4f2edab7521efdb1e58571468d33","tags":[]},{"url":"https://git.kernel.org/stable/c/94971ba0592ca77ec99b292226a4b398763315b8","tags":[]},{"url":"https://git.kernel.org/stable/c/9de48ba68f56de9fe20ebd3f9728d22af25f9a91","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability in the Linux kernel's ov02a10 driver leads to a use-after-free condition and potential probe failure, due to improper handling of endpoint parsing and property reading.","exploitability":"Exploitation requires access to the affected I2C device and knowledge of the specific property handling. The vulnerability is not easily exploitable without detailed knowledge of the device configuration.","blast_radius":"If exploited, the impact is limited to the affected device and could result in probe failures, potentially disrupting camera functionality or other I2C-based operations.","remediation":"Upgrade to the fixed version 5.19.13 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["use-after-free","i2c","linux-kernel"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-08T08:43:12.077Z"}}