Not yet scoredPublished Sep 16, 2026

CVE-2026-89871media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure

Updated under an hour ago (Oct 26, 2026, 11:50 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure kthread_run() returns an ERR_PTR on failure, not NULL. When start_streaming() fails, data->kthread_vid_cap is left holding this error pointer instead of being cleared. This causes two subsequent bugs: 1. A future call to start_streaming() sees a non-NULL kthread_vid_cap and returns 0 (success) immediately, without actually starting the capture thread. 2. A call to stop_streaming() checks 'kthread_vid_cap == NULL' which is false for an error pointer, and proceeds to call kthread_stop() on the error pointer, leading to a kernel crash. Fix this by resetting kthread_vid_cap to NULL on failure before jumping to the error path.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 5cebaac609744414463d1ecc28fdecd26c1b9bc1 before db0f4531aa55cfb0171684ebfffe3ff04b79d5a8; 5cebaac609744414463d1ecc28fdecd26c1b9bc1 builds before 0fac63cac6689588da530764ccb6ba55ee8e4d8b; 5cebaac609744414463d1ecc28fdecd26c1b9bc1 builds before 5c35d380bea60503c4fe0986fe1de6a3263282b3; 5cebaac609744414463d1ecc28fdecd26c1b9bc1 builds before 3d1b10d81fe54852ed953f4129577b733bbd6907; from 5cebaac609744414463d1ecc28fdecd26c1b9bc1 before 968c5213e34c48d35febdfd09cf3dc58ad039140; from 5cebaac609744414463d1ecc28fdecd26c1b9bc1 before 52fd9d80c0cea7bf09e7ee36cad316e5c39b7fe6; 5cebaac609744414463d1ecc28fdecd26c1b9bc1 builds before 0e7f2cd72a4f9268ee09a13b13f3339e7cc71557; from 5cebaac609744414463d1ecc28fdecd26c1b9bc1 before 76e379754ba618989f6215be608d5c04774a611d	CNA record

References

References

https://git.kernel.org/stable/c/db0f4531aa55cfb0171684ebfffe3ff04b79d5a8
https://git.kernel.org/stable/c/0fac63cac6689588da530764ccb6ba55ee8e4d8b
https://git.kernel.org/stable/c/5c35d380bea60503c4fe0986fe1de6a3263282b3
https://git.kernel.org/stable/c/3d1b10d81fe54852ed953f4129577b733bbd6907
https://git.kernel.org/stable/c/968c5213e34c48d35febdfd09cf3dc58ad039140
https://git.kernel.org/stable/c/52fd9d80c0cea7bf09e7ee36cad316e5c39b7fe6
https://git.kernel.org/stable/c/0e7f2cd72a4f9268ee09a13b13f3339e7cc71557
https://git.kernel.org/stable/c/76e379754ba618989f6215be608d5c04774a611d

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.