https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 16:55:24 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89888 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: i2c: ov02a10: fix endpoint parsing use-after-free</p> <p>The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint. However, it subsequently calls fwnode_property_read_u32() using the same &#39;ep&#39; handle, leading to a potential use-after-free.</p> <p>Additionally, reading the optional &#39;ovti,mipi-clock-voltage&#39; property used to overwrite the &#39;ret&#39; variable. If the property was missing, &#39;ret&#39; would become negative, and this failure code would be incorrectly returned at the end of the function, causing probe to fail entirely.</p> <p>Fix the use-after-free by moving fwnode_property_read_u32() before the endpoint is parsed and freed. Avoid the error leak by not assigning the result of fwnode_property_read_u32() to &#39;ret&#39;.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: i2c: ov02a10: fix endpoint parsing use-after-free</p> <p>The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint. However, it subsequently calls fwnode_property_read_u32() using the same &#39;ep&#39; handle, leading to a potential use-after-free.</p> <p>Additionally, reading the optional &#39;ovti,mipi-clock-voltage&#39; property used to overwrite the &#39;ret&#39; variable. If the property was missing, &#39;ret&#39; would become negative, and this failure code would be incorrectly returned at the end of the function, causing probe to fail entirely.</p> <p>Fix the use-after-free by moving fwnode_property_read_u32() before the endpoint is parsed and freed. Avoid the error leak by not assigning the result of fwnode_property_read_u32() to &#39;ret&#39;.</p> https://vulnerability.circl.lu/vuln/cve-2026-89888