{"id":"CVE-2026-89888","revision":"3b36c02dc8b748938bf84e4de7e549ab","records":[{"revision":"3b36c02dc8b748938bf84e4de7e549ab","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89888","aliases":[],"title":"media: i2c: ov02a10: fix endpoint parsing use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ov02a10: fix endpoint parsing use-after-free\n\nThe ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)\nimmediately after allocating and parsing the endpoint. However, it\nsubsequently calls fwnode_property_read_u32() using the same 'ep'\nhandle, leading to a potential use-after-free.\n\nAdditionally, reading the optional 'ovti,mipi-clock-voltage' property\nused to overwrite the 'ret' variable. If the property was missing,\n'ret' would become negative, and this failure code would be incorrectly\nreturned at the end of the function, causing probe to fail entirely.\n\nFix the use-after-free by moving fwnode_property_read_u32() before\nthe endpoint is parsed and freed. Avoid the error leak by not\nassigning the result of fwnode_property_read_u32() to 'ret'.","state":0,"publishedAt":"2026-09-16T10:31:51.892+00:00","modifiedAt":"2026-10-19T08:54:21.332+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/media/i2c/ov02a10.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"91807efbe8ec7f591085067d9f96a112e015274b\",\n                            \"lessThan\": \"9de48ba68f56de9fe20ebd3f9728d22af25f9a91\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"91807efbe8ec7f591085067d9f96a112e015274b\",\n                            \"lessThan\": \"8ddb3b69f67b0632ff3830da18de3e8dcaf5884b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"91807efbe8ec7f591085067d9f96a112e015274b\",\n                            \"lessThan\": \"4c2988bf1ad2753240a38db10ce23e87ec542f8f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"91807efbe8ec7f591085067d9f96a112e015274b\",\n                            \"lessThan\": \"213b2489130357c8d3e8d4fb2bdab88791ce3185\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"91807efbe8ec7f591085067d9f96a112e015274b\",\n                            \"lessThan\": \"90f9b421fc6d4f2edab7521efdb1e58571468d33\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"91807efbe8ec7f591085067d9f96a112e015274b\",\n                            \"lessThan\": \"6e13784452785cd8402b228bea53bc6a027ade84\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"91807efbe8ec7f591085067d9f96a112e015274b\",\n                            \"lessThan\": \"94971ba0592ca77ec99b292226a4b398763315b8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/media/i2c/ov02a10.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/9de48ba68f56de9fe20ebd3f9728d22af25f9a91","https://git.kernel.org/stable/c/8ddb3b69f67b0632ff3830da18de3e8dcaf5884b","https://git.kernel.org/stable/c/4c2988bf1ad2753240a38db10ce23e87ec542f8f","https://git.kernel.org/stable/c/213b2489130357c8d3e8d4fb2bdab88791ce3185","https://git.kernel.org/stable/c/90f9b421fc6d4f2edab7521efdb1e58571468d33","https://git.kernel.org/stable/c/6e13784452785cd8402b228bea53bc6a027ade84","https://git.kernel.org/stable/c/94971ba0592ca77ec99b292226a4b398763315b8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89888","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89888","identifiers":["CVE-2026-89888"]},"retained":false,"historicalAffected":[]}],"coverage":[]}