CVE-2026-89901

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref

airspy_disconnect() clears s->udev under v4l2_lock, but

airspy_stop_streaming() unconditionally calls airspy_ctrl_msg() and

airspy_free_stream_bufs() afterwards. If a streaming user closes the

device after disconnect, stop_streaming() runs and dereferences the

NULL s->udev:

airspy_stop_streaming()

airspy_ctrl_msg(s, CMD_RECEIVER_MODE, 0, 0, NULL, 0)

usb_sndctrlpipe(s->udev, 0) /* NULL deref */

airspy_free_stream_bufs(s)

usb_free_coherent(s->udev, ...) /* NULL deref */

The airspy driver uses vb2_fop_release() in its file_operations, so

replace video_unregister_device(&s->vdev) with

vb2_video_unregister_device(&s->vdev) and move it before clearing

s->udev. vb2_video_unregister_device() releases the vb2 queue, which

synchronously runs airspy_stop_streaming() if streaming is active, so

the URBs, coherent D

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References