Look up another CVE · open CVE-2026-89888 in the interactive tracker
CVE-2026-89888
media: i2c: ov02a10: fix endpoint parsing use-after-free
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem drivers/media. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-89888 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint. However, it subsequently calls fwnode_property_read_u32() using the same 'ep' handle, leading to a potential use-after-free. Additionally, reading the optional 'ovti,mipi-clock-voltage' property used to overwrite the 'ret' variable. If the property was missing, 'ret' would become negative, and this failure code would be incorrectly returned at the end of the function, causing probe to fail entirely. Fix the use-after-free by moving fwnode_property_read_u32() before the endpoint is parsed and freed. Avoid the error leak by not assigning the result of fwnode_property_read_u32() to 'ret'.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/media/i2c/ov02a10.c
- What this is
- OMNIVISION OV02A10 SENSOR DRIVERMAINTAINERS section matched on drivers/media/i2c/ov02a10.c · linux-media@vger.kernel.org · Orphan
- Kernel module
- none to look for. The file would have gone into ov02a10, and Debian does not compile it into that module, so finding ov02a10 in lsmod would say nothing about this CVE.
Check it on the machine
grep -w CONFIG_VIDEO_OV02A10 /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12n
- n
- not enabled on any flavour - this release does not build the code
- Build switch
- CONFIG_VIDEO_OV02A10
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 4.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/media
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.11 | 5.15.221 | 9de48ba68f56 |
| 5.11 | 6.1.188 | 8ddb3b69f67b |
| 5.11 | 6.6.157 | 4c2988bf1ad2 |
| 5.11 | 6.12.110 | 213b24891303 |
| 5.11 | 6.18.51 | 90f9b421fc6d |
| 5.11 | 7.2.5 | 6e1378445278 |
| 5.11 | 7.3 | 94971ba0592c |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The use-after-free is in ov02a10_check_hwcfg() on the I2C probe path of the onboard OmniVision OV02A10 MIPI CSI-2 camera sensor (MediaTek phones, IoT cameras). It is reached only via local driver bind (boot, module load, or sysfs), not via network packets, Bluetooth/Wi-Fi, or USB.
- AC:LAttack complexity, low
- After v4l2_fwnode_endpoint_alloc_parse() succeeds, fwnode_handle_put(ep) is immediately followed by fwnode_property_read_u32(ep) on every probe with no race or attacker-uncontrollable layout. A local attacker who rebinds the driver or is present for boot/deferred probe triggers it reliably.
- PR:LPrivileges required, low
- ov02a10_probe() runs automatically at boot on DT-described OV02A10 cameras with no capable() check; sysfs bind is 0200, but CNA practice scores ambiguous probe/bind gating as Low rather than init-namespace root. An unprivileged local user on the phone or kiosk is sufficient.
- UI:NUser interaction, none
- The dangling endpoint fwnode is consumed inside driver probe itself. No victim must open /dev/v4l-subdev*, mount a filesystem, or plug in hardware.
- S:UScope, unchanged
- The fwnode/device_node use-after-free corrupts host-kernel heap within the same security authority. This is standard in-kernel memory corruption, not a VM escape, IOMMU/DMA bypass, or sandbox breakout.
- C:HConfidentiality impact, high
- fwnode_property_read_u32() calls fwnode_call_int_op(), which reads fwnode->ops from the endpoint after its reference was dropped. On dynamic OF overlay or software-node graphs that free on last put, that slab use-after-free read is Confidentiality High per UAF guidance.
- I:HIntegrity impact, high
- The same dangling fwnode_handle.ops is dispatched as property_read_int_array(); reclaiming the freed node with a forged ops table yields an indirect call and control-flow hijack. Kernel guidance scores use-after-free as Integrity High.
- A:HAvailability impact, high
- Dispatch through a freed fwnode ops pointer oopses or panics the kernel during camera probe on affected phones and embedded devices. Any use-after-free is Availability High even when not fully exploited.