{"id":"CVE-2026-89733","summary":"usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()\n\nIn uvc_function_bind() error path, we use usb_ep_free_request which\nuses uvc-\u003econtrol_req but does not set it to NULL afterwards. Thus,\nuvc-\u003econtrol_req is a dangling pointer causing a UAF. Also we do not set\nthe uvc-\u003econtrol_buf pointer to NULL after freeing it, which is another\ndangling pointer. Fix it by setting uvc-\u003econtrol_req to NULL after we run\nusb_ep_free_request() and uvc-\u003econtrol_buf to NULL after kfree. Do the\nsame for uvc_function_unbind().","modified":"2026-11-13T04:00:35.376166399Z","published":"2026-09-11T19:46:42.613Z","related":["SUSE-SU-2026:24550-1","SUSE-SU-2026:24619-1","SUSE-SU-2026:24643-1","SUSE-SU-2026:24648-1","SUSE-SU-2026:24651-1","SUSE-SU-2026:24662-1","SUSE-SU-2026:5091-1","openSUSE-SU-2026:11880-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89733.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/38f822ddce9355893d734279a26ddec45182197e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/502a7f5b79b7ba751988789e982924f8f496129f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/85dd5e8bd6776d02854f2847d83429f1f712e99c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8e88ed8a374de67270d38689f2a81018909cafbb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9897b7da8c0ad8356c1b8649379fcb5a689462cb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bec7708eb3b5295d12e931db24381b7c94c72953"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ddb1b0d5d858584ed0d3a5aaa042ee693998c7e2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89733.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89733"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0f9df939385527049c8062a099fbfa1479fe7ce0"},{"fixed":"ddb1b0d5d858584ed0d3a5aaa042ee693998c7e2"},{"fixed":"85dd5e8bd6776d02854f2847d83429f1f712e99c"},{"fixed":"502a7f5b79b7ba751988789e982924f8f496129f"},{"fixed":"bec7708eb3b5295d12e931db24381b7c94c72953"},{"fixed":"8e88ed8a374de67270d38689f2a81018909cafbb"},{"fixed":"9897b7da8c0ad8356c1b8649379fcb5a689462cb"},{"fixed":"38f822ddce9355893d734279a26ddec45182197e"},{"fixed":"bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"1efa8a5aac93d9e67075995d7d4902b57ce184f7"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e7a4b0efe62e56a0acc81d16091c6efc2a282be8"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"065f5561a20659cf17aae5f72b32b5c2695c8e00"}]}],"versions":["v3.2.102","v3.2.101","v3.2.100","v3.2.99","v3.2.98","v3.2.97","v3.2.96","v3.2.95","v3.2.94","v3.2.93","v3.2.92","v3.2.91","v3.2.90","v3.2.89","v3.2.88","v3.2.87","v3.2.86","v3.2.85","v3.2.84","v3.2.83","v3.2.82","v3.2.81","v3.2.80","v3.2.79","v3.2.78","v3.2.77","v3.2.76","v3.2.75","v3.2.74","v3.2.73","v3.2.72","v3.2.71","v3.2.70","v3.2.69","v3.2.68","v3.2.67","v3.2.66","v3.2.65","v3.2.64","v3.2.63","v3.2.62","v3.2.61","v3.2.60","v3.2.59","v3.2.58","v3.2.57","v3.2.56","v3.2.55","v3.2.54","v3.2.53","v3.2.52","v3.2.51","v3.2.50","v3.2.49","v3.2.48","v3.2.47","v3.2.46","v3.2.45","v3.2.44","v3.2.43","v3.2.42","v3.2.41","v3.2.40","v3.2.39","v3.2.38","v3.2.37","v3.2.36","v3.4.113","v3.4.112","v3.4.111","v3.4.110","v3.4.109","v3.4.108","v3.4.107","v3.4.106","v3.4.105","v3.4.104","v3.4.103","v3.4.102","v3.4.101","v3.4.100","v3.4.99","v3.4.98","v3.4.97","v3.4.96","v3.4.95","v3.4.94","v3.4.93","v3.4.92","v3.4.91","v3.4.90","v3.4.89","v3.4.88","v3.4.87","v3.4.86","v3.4.85","v3.4.84","v3.4.83","v3.4.82","v3.4.81","v3.4.80","v3.4.79","v3.4.78","v3.4.77","v3.4.76","v3.4.75","v3.4.74","v3.4.73","v3.4.72","v3.4.71","v3.4.70","v3.4.69","v3.4.68","v3.4.67","v3.4.66","v3.4.65","v3.4.64","v3.4.63","v3.4.62","v3.4.61","v3.4.60","v3.4.59","v3.4.58","v3.4.57","v3.4.56","v3.4.55","v3.4.54","v3.4.53","v3.4.52","v3.4.51","v3.4.50","v3.4.49","v3.4.48","v3.4.47","v3.4.46","v3.4.45","v3.4.44","v3.4.43","v3.4.42","v3.4.41","v3.4.40","v3.4.39","v3.4.38","v3.4.37","v3.4.36","v3.4.35","v3.4.34","v3.4.33","v3.4.32","v3.4.31","v3.4.30","v3.4.29","v3.4.28","v3.4.27","v3.4.26","v3.4.25","v3.7.10","v3.7.9","v3.7.8","v3.7.7","v3.7.6","v3.7.5","v3.7.4","v3.7.3","v3.7.2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89733.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.36"},{"fixed":"3.3"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.4.25"},{"fixed":"3.5"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.7.2"},{"fixed":"3.8"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.8.0"},{"fixed":"5.10.270"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.221"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.109"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.50"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89733.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}