PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89733 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's USB gadget UVC (uvc) driver, specifically in the `uvc_function_bind()` and `uvc_function_unbind()` functions. When an error occurs during the binding process, dangling pointers to `uvc->control_req` and `uvc->control_buf` are not properly set to NULL, leading to potential use-after-free (UAF) attacks.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-10-19
Advisory published
2026-09-11
Advisory updated
2026-10-19

Who should care

Linux kernel developers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and apply patches or updates as needed. They should verify Linux kernel versions and apply patches to prevent UAF attacks. System administrators should review system configurations and ensure proper USB gadget UVC driver usage.

Why it matters

This vulnerability allows attackers to potentially execute arbitrary code or cause a denial-of-service (DoS) on affected Linux-based systems. Linux kernel developers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and apply patches or updates as needed.

  • Verify Linux kernel versions and apply patches to prevent UAF attacks
  • Monitor Linux kernel security advisories for future updates
  • Review system configurations and ensure proper USB gadget UVC driver usage

Technical summary

The Linux kernel's USB gadget UVC driver has a use-after-free vulnerability in the `uvc_function_bind()` and `uvc_function_unbind()` functions. When an error occurs during binding, `uvc->control_req` and `uvc->control_buf` pointers are not set to NULL, allowing for potential UAF attacks. This vulnerability allows attackers to potentially execute arbitrary code or cause a denial-of-service (DoS) on affected Linux-based systems. Linux kernel developers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and apply patches or updates as needed.

Defensive priority

High

Recommended defensive actions

  • Review and apply patches from the Linux kernel maintainers
  • Update Linux kernel to a version that includes the fix
  • Monitor Linux kernel security advisories for future updates
  • Verify Linux kernel versions and apply patches to prevent UAF attacks
  • Review system configurations and ensure proper USB gadget UVC driver usage
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. The Linux kernel's official Git repository contains commits addressing the issue. Affected Linux kernel versions should be verified, and patches applied to prevent use-after-free attacks. Defenders should review system configurations and ensure proper USB gadget UVC driver usage. Linux kernel developers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and apply patches or updates as needed.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89733 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89733

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89733 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89733

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89733.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ddb1b0d5d858584ed0d3a5aaa042ee693998c7e2

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/85dd5e8bd6776d02854f2847d83429f1f712e99c

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/502a7f5b79b7ba751988789e982924f8f496129f

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bec7708eb3b5295d12e931db24381b7c94c72953

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8e88ed8a374de67270d38689f2a81018909cafbb

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9897b7da8c0ad8356c1b8649379fcb5a689462cb

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/38f822ddce9355893d734279a26ddec45182197e

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.