CVE-2026-89874

A flaw was found in the Linux kernel's v4l2-async media subsystem. When creating ancillary media links, the v4l2_async_match_notify() function attempts to delete an unlinked entry if the link creation fails. This can lead to a null pointer dereference, potentially causing a system crash. A local attacker could exploit this vulnerability to cause a Denial of Service.

This vulnerability is rated with a Low severity impact for Red Hat Enterprise Linux because triggering the issue requires specific media hardware sub-device binding failures during driver registration, limiting the blast radius to a local denial of service under rare error conditions. Video4Linux2 subsystems and hardware capture devices are typically not present or active in standard enterprise server deployments, substantially reducing exposure. Furthermore, older enterprise platforms such as Red Hat Enterprise Linux 8 and 9 do not contain the vulnerable code path and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.