Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89892— media: em28xx: defer audio-only extension registration

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： media: em28xx: 延迟仅音频扩展的注册 仅音频路径在探测主设备时注册扩展。对于双 TS（双传输流）板卡，此操作发生在 被创建之前。重复的设备会继承 标志，并被独立插入到 中。 该列表本应仅包含主设备：扩展操作应通过 访问次要设备。被独立链接的次要设备可能在断开连接时被释放，但其链表节点仍然可达，从而导致释放后使用（use-after-free）错误。 修复方案： 将仅音频扩展的注册延迟到模块请求的工作项（module-request work item）中执行。

AI Predicted 4.4 Difficulty: Hard EPSS 0.21% · P10

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 4a089668ef22c295ed4997289cc48446c849249c< 0da1e627f4fc9d0e947fdae90913042120878923 affected
4a089668ef22c295ed4997289cc48446c849249c< f8d7e77d9c621b42a191c67a9b37bec23dc1d555 affected
4a089668ef22c295ed4997289cc48446c849249c< 1abe9524dec0fd26e9ceb8d586034d6f68dd8273 affected
4a089668ef22c295ed4997289cc48446c849249c< 4e11c45dfdc72ab656067b1df8fcebaf52fd4715 affected
4a089668ef22c295ed4997289cc48446c849249c< d06067ee32620f272cfb80c7bc7c572ad4e74724 affected
4a089668ef22c295ed4997289cc48446c849249c< f9322ac9f862961d7f377b87ec26c8565af7e073 affected
4a089668ef22c295ed4997289cc48446c849249c< 4666197ca4f7d80cd3b0292054fe45d76be9ba04 affected
4a089668ef22c295ed4997289cc48446c849249c< 95f76f51937fdfb0fc1e14cae606b1ef574a56f3 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89892

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
media: em28xx: defer audio-only extension registration
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: media: em28xx: defer audio-only extension registration The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before dev_next is created. The duplicate device inherits is_audio_only and is then independently inserted into em28xx_devlist. The list is intended to contain only primary devices: extension operations reach the secondary device through dev_next. The independently linked secondary can be freed during disconnect while its list node remains reachable, resulting in a use-after-free. Defer audio-only extension registration to the module-request work item. It runs only after probing has completed construction of the optional secondary device, so only the primary is registered and extension callbacks reach the secondary through dev_next.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 4a089668ef22c295ed4997289cc48446c849249c ~ 0da1e627f4fc9d0e947fdae90913042120878923 -
Linux Linux 4.17 -

II. Public POCs for CVE-2026-89892

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89892

请登录查看更多情报信息。

Other References for CVE-2026-89892 (8)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89930 9.3 CRITICAL KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89892

No comments yet

Leave a comment