CVE-2026-89874

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-async: avoid deleting unlinked ASC entry on link error

v4l2_async_match_notify() creates ancillary media links before adding

asc->asc_subdev_entry to sd->asc_list.

If ancillary link creation fails, the function jumps to

err_call_unbind while asc_subdev_entry has not been linked yet. Async

connections are zero-allocated, so the list entry still has NULL next

and prev pointers on this path. Calling list_del() on it can therefore

dereference NULL instead of returning the original link creation error.

Do not delete asc_subdev_entry from err_call_unbind. There is no list

insertion to undo on this path; the bound callback and sub-device

registration are the operations that need to be rolled back.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References