CVE-2026-89901: In the Linux kernel, the following vulnerability has been resolved: media: airspy: use vb2_video_unregister_device() on
Summary
A Linux kernel driver for the airspy device had a NULL pointer dereference bug (accessing a memory location that points to nothing) that occurred when a user closed the device after it was disconnected. The problem happened because the driver cleared a USB device pointer (s->udev) while streaming operations were still trying to use it. The vulnerability was fixed by using vb2_video_unregister_device() instead of video_unregister_device() to properly stop streaming before clearing the pointer, ensuring all hardware operations complete while the USB device reference is still valid.
Solution / Mitigation
Replace video_unregister_device(&s->vdev) with vb2_video_unregister_device(&s->vdev) and move it before clearing s->udev. This change ensures that vb2_video_unregister_device() releases the vb2 queue (a video buffer management system) and synchronously runs airspy_stop_streaming() if streaming is active, so all USB operations execute while s->udev is still valid. Remove the previous outer mutex_lock pairs around the unregister sequence to avoid self-deadlock, and keep only a short v4l2_lock critical section around s->udev = NULL assignment.
Vulnerability Details
EPSS: 0.0%
September 16, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-89901
First tracked: September 16, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 95%