{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89888","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-11T19:38:34.773Z","datePublished":"2026-09-16T10:31:51.892Z","dateUpdated":"2026-09-16T14:39:38.808Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-16T14:39:38.808Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ov02a10: fix endpoint parsing use-after-free\n\nThe ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)\nimmediately after allocating and parsing the endpoint. However, it\nsubsequently calls fwnode_property_read_u32() using the same 'ep'\nhandle, leading to a potential use-after-free.\n\nAdditionally, reading the optional 'ovti,mipi-clock-voltage' property\nused to overwrite the 'ret' variable. If the property was missing,\n'ret' would become negative, and this failure code would be incorrectly\nreturned at the end of the function, causing probe to fail entirely.\n\nFix the use-after-free by moving fwnode_property_read_u32() before\nthe endpoint is parsed and freed. Avoid the error leak by not\nassigning the result of fwnode_property_read_u32() to 'ret'."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The use-after-free is in ov02a10_check_hwcfg() on the I2C probe path of the onboard OmniVision OV02A10 MIPI CSI-2 camera sensor (MediaTek phones, IoT cameras). It is reached only via local driver bind (boot, module load, or sysfs), not via network packets, Bluetooth/Wi-Fi, or USB.\nAC:L - After v4l2_fwnode_endpoint_alloc_parse() succeeds, fwnode_handle_put(ep) is immediately followed by fwnode_property_read_u32(ep) on every probe with no race or attacker-uncontrollable layout. A local attacker who rebinds the driver or is present for boot/deferred probe triggers it reliably.\nPR:L - ov02a10_probe() runs automatically at boot on DT-described OV02A10 cameras with no capable() check; sysfs bind is 0200, but CNA practice scores ambiguous probe/bind gating as Low rather than init-namespace root. An unprivileged local user on the phone or kiosk is sufficient.\nUI:N - The dangling endpoint fwnode is consumed inside driver probe itself. No victim must open /dev/v4l-subdev*, mount a filesystem, or plug in hardware.\nS:U - The fwnode/device_node use-after-free corrupts host-kernel heap within the same security authority. This is standard in-kernel memory corruption, not a VM escape, IOMMU/DMA bypass, or sandbox breakout.\nC:H - fwnode_property_read_u32() calls fwnode_call_int_op(), which reads fwnode->ops from the endpoint after its reference was dropped. On dynamic OF overlay or software-node graphs that free on last put, that slab use-after-free read is Confidentiality High per UAF guidance.\nI:H - The same dangling fwnode_handle.ops is dispatched as property_read_int_array(); reclaiming the freed node with a forged ops table yields an indirect call and control-flow hijack. Kernel guidance scores use-after-free as Integrity High.\nA:H - Dispatch through a freed fwnode ops pointer oopses or panics the kernel during camera probe on affected phones and embedded devices. Any use-after-free is Availability High even when not fully exploited."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/i2c/ov02a10.c"],"versions":[{"version":"91807efbe8ec7f591085067d9f96a112e015274b","lessThan":"9de48ba68f56de9fe20ebd3f9728d22af25f9a91","status":"affected","versionType":"git"},{"version":"91807efbe8ec7f591085067d9f96a112e015274b","lessThan":"8ddb3b69f67b0632ff3830da18de3e8dcaf5884b","status":"affected","versionType":"git"},{"version":"91807efbe8ec7f591085067d9f96a112e015274b","lessThan":"4c2988bf1ad2753240a38db10ce23e87ec542f8f","status":"affected","versionType":"git"},{"version":"91807efbe8ec7f591085067d9f96a112e015274b","lessThan":"213b2489130357c8d3e8d4fb2bdab88791ce3185","status":"affected","versionType":"git"},{"version":"91807efbe8ec7f591085067d9f96a112e015274b","lessThan":"90f9b421fc6d4f2edab7521efdb1e58571468d33","status":"affected","versionType":"git"},{"version":"91807efbe8ec7f591085067d9f96a112e015274b","lessThan":"6e13784452785cd8402b228bea53bc6a027ade84","status":"affected","versionType":"git"},{"version":"91807efbe8ec7f591085067d9f96a112e015274b","lessThan":"94971ba0592ca77ec99b292226a4b398763315b8","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/i2c/ov02a10.c"],"versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","status":"unaffected","versionType":"semver"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.1.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.18.51"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"7.2.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"7.3-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9de48ba68f56de9fe20ebd3f9728d22af25f9a91"},{"url":"https://git.kernel.org/stable/c/8ddb3b69f67b0632ff3830da18de3e8dcaf5884b"},{"url":"https://git.kernel.org/stable/c/4c2988bf1ad2753240a38db10ce23e87ec542f8f"},{"url":"https://git.kernel.org/stable/c/213b2489130357c8d3e8d4fb2bdab88791ce3185"},{"url":"https://git.kernel.org/stable/c/90f9b421fc6d4f2edab7521efdb1e58571468d33"},{"url":"https://git.kernel.org/stable/c/6e13784452785cd8402b228bea53bc6a027ade84"},{"url":"https://git.kernel.org/stable/c/94971ba0592ca77ec99b292226a4b398763315b8"}],"title":"media: i2c: ov02a10: fix endpoint parsing use-after-free","x_generator":{"engine":"bippy-1.2.0"}}}}