CVE-2026-89891

A flaw was found in the em28xx media driver of the Linux kernel. When a specific type of device is disconnected, a programming error can occur where a pointer to freed memory remains in an active list. This "use-after-free" vulnerability can be triggered by a local attacker or a malicious USB device, leading to list corruption and potentially causing system instability or a denial of service.

A use after free can occur in the em28xx USB media driver because dev_next devlist remains linked in the global em28xx_devlist after device disconnect. After dev_next is freed, the global list can contain a dangling list entry and a later device probe can trigger list corruption or traversal of freed memory. For the CVSS the PR:N value is used for the paranoid score because a malicious USB device can trigger the vulnerable driver path without a user account on the target host. The attack is not network reachable and normally requires physical USB access or an equivalent USB device emulation path. Impact is at least denial of service via kernel crash. In the worst still defensible interpretation, the dangling list entry is a kernel UAF condition that may allow confidentiality or integrity impact if freed memory is reclaimed in an attacker influenced way.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.