{"id":"CVE-2026-89733","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-89733","summary":"usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()\n\nIn uvc_function_bind() error path, we use usb_ep_free_request which\nuses uvc->control_req but does not set it to NULL afterwards. Thus,\nuvc->control_req is a dangling pointer causing a UAF. Also we do not set\nthe uvc->control_buf pointer to NULL after freeing it, which is another\ndangling pointer. Fix it by setting uvc->control_req to NULL after we run\nusb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the\nsame for uvc_function_unbind().","published":"2026-09-11T19:46:42.613Z","modified":"2026-09-14T03:46:36.084819408Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.12.109"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/38f822ddce9355893d734279a26ddec45182197e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8e88ed8a374de67270d38689f2a81018909cafbb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9897b7da8c0ad8356c1b8649379fcb5a689462cb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89733.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89733"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-14T03:46:36.084819408Z"}}