CVE-2026-89892

A flaw was found in the Linux kernel's em28xx media driver. This vulnerability occurs because the audio-only path incorrectly registers extensions during device probing, leading to a duplicate device entry in an internal list. This duplicate entry can be freed while still being referenced, resulting in a use-after-free condition. A local attacker could potentially exploit this to cause a denial of service or achieve arbitrary code execution.

A use-after-free in the em28xx USB media driver can occur because audio-only extension registration may happen before the optional secondary device is fully constructed. On a dual-TS board the secondary device can inherit is_audio_only and be inserted into em28xx_devlist as an independent entry, although extension operations are expected to reach it through dev_next from the primary device. During disconnect the secondary device can be freed while its list node remains reachable, leaving a stale kernel pointer that may be used by later extension callbacks. For the CVSS the PR:N is selected because no privileges on the target system are required if the attacker can present a crafted or affected USB device to the host. The issue is not network reachable in normal deployments and requires physical or local USB device access. Impact is at least denial of service via kernel crash and in the paranoid model may include confidentiality and integrity impact because the bug class is kernel use-after-free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.