{"id":"CVE-2026-89901","revision":"0b1881a14a5647c28699b42bacafbc45","records":[{"revision":"0b1881a14a5647c28699b42bacafbc45","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89901","aliases":[],"title":"media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref\n\nairspy_disconnect() clears s->udev under v4l2_lock, but\nairspy_stop_streaming() unconditionally calls airspy_ctrl_msg() and\nairspy_free_stream_bufs() afterwards. If a streaming user closes the\ndevice after disconnect, stop_streaming() runs and dereferences the\nNULL s->udev:\n\n  airspy_stop_streaming()\n    airspy_ctrl_msg(s, CMD_RECEIVER_MODE, 0, 0, NULL, 0)\n      usb_sndctrlpipe(s->udev, 0)         /* NULL deref */\n    airspy_free_stream_bufs(s)\n      usb_free_coherent(s->udev, ...)     /* NULL deref */\n\nThe airspy driver uses vb2_fop_release() in its file_operations, so\nreplace video_unregister_device(&s->vdev) with\nvb2_video_unregister_device(&s->vdev) and move it before clearing\ns->udev. vb2_video_unregister_device() releases the vb2 queue, which\nsynchronously runs airspy_stop_streaming() if streaming is active, so\nthe URBs, coherent DMA stream buffers and the hardware stop control\nmessage all execute while s->udev is still valid.\n\nvb2_video_unregister_device() locks vdev->queue->lock (vb_queue_lock)\ninternally, and stop_streaming() locks v4l2_lock, so the previous outer\nmutex_lock(&s->vb_queue_lock) / mutex_lock(&s->v4l2_lock) pair around\nthe unregister sequence would self-deadlock and has been removed. A\nshort v4l2_lock critical section around s->udev = NULL remains so any\nioctl path that still holds the file descriptor sees coherent state.\n\nIssue identified by automated review of the INV-003 series at\nhttps://sashiko.dev/","state":0,"publishedAt":"2026-09-16T10:32:00.997+00:00","modifiedAt":"2026-10-19T08:54:34.11+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/media/usb/airspy/airspy.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"634fe5033951b80ef4b98d8f047cb1083d29170d\",\n                            \"lessThan\": \"c9081e2655188d2d134a741aec837dc70439d505\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"634fe5033951b80ef4b98d8f047cb1083d29170d\",\n                            \"lessThan\": \"75089cea32e5055773bd13116236d08fdc98678a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"634fe5033951b80ef4b98d8f047cb1083d29170d\",\n                            \"lessThan\": \"155d0378ae0d6305cc4840583a6b42d2d0595bff\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"634fe5033951b80ef4b98d8f047cb1083d29170d\",\n                            \"lessThan\": \"6e4ea90fdc6608cd5fac342e146ab6ae15d430bc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"634fe5033951b80ef4b98d8f047cb1083d29170d\",\n                            \"lessThan\": \"a9a8c37ddda9fa3687b142be9098e1c37b8faf35\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"634fe5033951b80ef4b98d8f047cb1083d29170d\",\n                            \"lessThan\": \"297fee023f46d771a844520675692ea089d80d9d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"634fe5033951b80ef4b98d8f047cb1083d29170d\",\n                            \"lessThan\": \"c6749ac8f59cc80eb1b2d52f167fdf13e12655cc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"634fe5033951b80ef4b98d8f047cb1083d29170d\",\n                            \"lessThan\": \"2f378dc45e685fc825d2dd08e7864666d6fcc009\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/media/usb/airspy/airspy.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.17\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.17\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/c9081e2655188d2d134a741aec837dc70439d505","https://git.kernel.org/stable/c/75089cea32e5055773bd13116236d08fdc98678a","https://git.kernel.org/stable/c/155d0378ae0d6305cc4840583a6b42d2d0595bff","https://git.kernel.org/stable/c/6e4ea90fdc6608cd5fac342e146ab6ae15d430bc","https://git.kernel.org/stable/c/a9a8c37ddda9fa3687b142be9098e1c37b8faf35","https://git.kernel.org/stable/c/297fee023f46d771a844520675692ea089d80d9d","https://git.kernel.org/stable/c/c6749ac8f59cc80eb1b2d52f167fdf13e12655cc","https://git.kernel.org/stable/c/2f378dc45e685fc825d2dd08e7864666d6fcc009"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89901","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89901","identifiers":["CVE-2026-89901"]},"retained":false,"historicalAffected":[]}],"coverage":[]}