GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89733 (GCVE-0-2026-89733)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-14 12:02
VLAI
Title
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() In uvc_function_bind() error path, we use usb_ep_free_request which uses uvc->control_req but does not set it to NULL afterwards. Thus, uvc->control_req is a dangling pointer causing a UAF. Also we do not set the uvc->control_buf pointer to NULL after freeing it, which is another dangling pointer. Fix it by setting uvc->control_req to NULL after we run usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the same for uvc_function_unbind().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0f9df939385527049c8062a099fbfa1479fe7ce0 , < ddb1b0d5d858584ed0d3a5aaa042ee693998c7e2 (git)
Affected: 0f9df939385527049c8062a099fbfa1479fe7ce0 , < 85dd5e8bd6776d02854f2847d83429f1f712e99c (git)
Affected: 0f9df939385527049c8062a099fbfa1479fe7ce0 , < 502a7f5b79b7ba751988789e982924f8f496129f (git)
Affected: 0f9df939385527049c8062a099fbfa1479fe7ce0 , < bec7708eb3b5295d12e931db24381b7c94c72953 (git)
Affected: 0f9df939385527049c8062a099fbfa1479fe7ce0 , < 8e88ed8a374de67270d38689f2a81018909cafbb (git)
Affected: 0f9df939385527049c8062a099fbfa1479fe7ce0 , < 9897b7da8c0ad8356c1b8649379fcb5a689462cb (git)
Affected: 0f9df939385527049c8062a099fbfa1479fe7ce0 , < 38f822ddce9355893d734279a26ddec45182197e (git)
Affected: 0f9df939385527049c8062a099fbfa1479fe7ce0 , < bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc (git)
Affected: 1efa8a5aac93d9e67075995d7d4902b57ce184f7 (git)
Affected: e7a4b0efe62e56a0acc81d16091c6efc2a282be8 (git)
Affected: 065f5561a20659cf17aae5f72b32b5c2695c8e00 (git)
Affected: 3.2.36 , < 3.3 (semver)
Affected: 3.4.25 , < 3.5 (semver)
Affected: 3.7.2 , < 3.8 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 3.8
Unaffected: 0 , < 3.8 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_uvc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ddb1b0d5d858584ed0d3a5aaa042ee693998c7e2",
              "status": "affected",
              "version": "0f9df939385527049c8062a099fbfa1479fe7ce0",
              "versionType": "git"
            },
            {
              "lessThan": "85dd5e8bd6776d02854f2847d83429f1f712e99c",
              "status": "affected",
              "version": "0f9df939385527049c8062a099fbfa1479fe7ce0",
              "versionType": "git"
            },
            {
              "lessThan": "502a7f5b79b7ba751988789e982924f8f496129f",
              "status": "affected",
              "version": "0f9df939385527049c8062a099fbfa1479fe7ce0",
              "versionType": "git"
            },
            {
              "lessThan": "bec7708eb3b5295d12e931db24381b7c94c72953",
              "status": "affected",
              "version": "0f9df939385527049c8062a099fbfa1479fe7ce0",
              "versionType": "git"
            },
            {
              "lessThan": "8e88ed8a374de67270d38689f2a81018909cafbb",
              "status": "affected",
              "version": "0f9df939385527049c8062a099fbfa1479fe7ce0",
              "versionType": "git"
            },
            {
              "lessThan": "9897b7da8c0ad8356c1b8649379fcb5a689462cb",
              "status": "affected",
              "version": "0f9df939385527049c8062a099fbfa1479fe7ce0",
              "versionType": "git"
            },
            {
              "lessThan": "38f822ddce9355893d734279a26ddec45182197e",
              "status": "affected",
              "version": "0f9df939385527049c8062a099fbfa1479fe7ce0",
              "versionType": "git"
            },
            {
              "lessThan": "bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc",
              "status": "affected",
              "version": "0f9df939385527049c8062a099fbfa1479fe7ce0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1efa8a5aac93d9e67075995d7d4902b57ce184f7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e7a4b0efe62e56a0acc81d16091c6efc2a282be8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "065f5561a20659cf17aae5f72b32b5c2695c8e00",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.36",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5",
              "status": "affected",
              "version": "3.4.25",
              "versionType": "semver"
            },
            {
              "lessThan": "3.8",
              "status": "affected",
              "version": "3.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_uvc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.4.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()\n\nIn uvc_function_bind() error path, we use usb_ep_free_request which\nuses uvc-\u003econtrol_req but does not set it to NULL afterwards. Thus,\nuvc-\u003econtrol_req is a dangling pointer causing a UAF. Also we do not set\nthe uvc-\u003econtrol_buf pointer to NULL after freeing it, which is another\ndangling pointer. Fix it by setting uvc-\u003econtrol_req to NULL after we run\nusb_ep_free_request() and uvc-\u003econtrol_buf to NULL after kfree. Do the\nsame for uvc_function_unbind()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached by local writes to /sys/kernel/config/usb_gadget/\u003cg\u003e/UDC that drive uvc_function_bind()/uvc_function_unbind(); no USB host traffic or physical attachment is required, matching prior gadget bind dangling-pointer scores and being higher severity than Physical.\nAC:L - The attacker controls the successful bind, the unbind that leaves uvc-\u003econtrol_req dangling, and a later bind that fails before reallocating (e.g. exhausting usb_ep_autoconfig(), as in the syzkaller \"Unable to allocate streaming EP\" crash), so the error path double-frees the usb_request with no race.\nPR:L - gadget_dev_desc_UDC_store() and uvc_function_bind() perform no capability check; access is gated only by configfs permissions, and Android/embedded USB gadget HALs routinely delegate /sys/kernel/config/usb_gadget to non-root system or daemon accounts.\nUI:N - The attacker performs the configfs UDC bind/unbind writes themselves; no victim action, cable plug, or other-user interaction is required.\nS:U - The dangling usb_request double-free corrupts kernel heap within the same kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - usb_ep_free_request() on the stale control_req is a use-after-free of a usb_request slab object; an attacker who sprays that cache controls the freed object and can convert the UAF into kernel memory disclosure.\nI:H - The same stale pointer is a double-free through ep-\u003eops-\u003efree_request, yielding classic heap-corruption primitives (object overlap and arbitrary free) that can be leveraged into arbitrary write and control-flow hijack.\nA:H - The syzkaller report is a KASAN slab-use-after-free oops in usb_ep_free_request() on the bind error path, and the double free independently panics the kernel, which the attacker can retrigger via configfs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:02:21.384Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ddb1b0d5d858584ed0d3a5aaa042ee693998c7e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/85dd5e8bd6776d02854f2847d83429f1f712e99c"
        },
        {
          "url": "https://git.kernel.org/stable/c/502a7f5b79b7ba751988789e982924f8f496129f"
        },
        {
          "url": "https://git.kernel.org/stable/c/bec7708eb3b5295d12e931db24381b7c94c72953"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e88ed8a374de67270d38689f2a81018909cafbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/9897b7da8c0ad8356c1b8649379fcb5a689462cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/38f822ddce9355893d734279a26ddec45182197e"
        },
        {
          "url": "https://git.kernel.org/stable/c/bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc"
        }
      ],
      "title": "usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89733",
    "datePublished": "2026-09-11T19:46:42.613Z",
    "dateReserved": "2026-09-11T19:38:34.760Z",
    "dateUpdated": "2026-09-14T12:02:21.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89733",
      "date": "2026-09-16",
      "epss": "0.00164",
      "percentile": "0.06052"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89733\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:20:03.730\",\"lastModified\":\"2026-09-14T13:19:22.430\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()\\n\\nIn uvc_function_bind() error path, we use usb_ep_free_request which\\nuses uvc-\u003econtrol_req but does not set it to NULL afterwards. Thus,\\nuvc-\u003econtrol_req is a dangling pointer causing a UAF. Also we do not set\\nthe uvc-\u003econtrol_buf pointer to NULL after freeing it, which is another\\ndangling pointer. Fix it by setting uvc-\u003econtrol_req to NULL after we run\\nusb_ep_free_request() and uvc-\u003econtrol_buf to NULL after kfree. Do the\\nsame for uvc_function_unbind().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/gadget/function/f_uvc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0f9df939385527049c8062a099fbfa1479fe7ce0\",\"lessThan\":\"ddb1b0d5d858584ed0d3a5aaa042ee693998c7e2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f9df939385527049c8062a099fbfa1479fe7ce0\",\"lessThan\":\"85dd5e8bd6776d02854f2847d83429f1f712e99c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f9df939385527049c8062a099fbfa1479fe7ce0\",\"lessThan\":\"502a7f5b79b7ba751988789e982924f8f496129f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f9df939385527049c8062a099fbfa1479fe7ce0\",\"lessThan\":\"bec7708eb3b5295d12e931db24381b7c94c72953\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f9df939385527049c8062a099fbfa1479fe7ce0\",\"lessThan\":\"8e88ed8a374de67270d38689f2a81018909cafbb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f9df939385527049c8062a099fbfa1479fe7ce0\",\"lessThan\":\"9897b7da8c0ad8356c1b8649379fcb5a689462cb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f9df939385527049c8062a099fbfa1479fe7ce0\",\"lessThan\":\"38f822ddce9355893d734279a26ddec45182197e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f9df939385527049c8062a099fbfa1479fe7ce0\",\"lessThan\":\"bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1efa8a5aac93d9e67075995d7d4902b57ce184f7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e7a4b0efe62e56a0acc81d16091c6efc2a282be8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"065f5561a20659cf17aae5f72b32b5c2695c8e00\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.2.36\",\"lessThan\":\"3.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.4.25\",\"lessThan\":\"3.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.7.2\",\"lessThan\":\"3.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/gadget/function/f_uvc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/38f822ddce9355893d734279a26ddec45182197e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/502a7f5b79b7ba751988789e982924f8f496129f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/85dd5e8bd6776d02854f2847d83429f1f712e99c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8e88ed8a374de67270d38689f2a81018909cafbb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9897b7da8c0ad8356c1b8649379fcb5a689462cb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bec7708eb3b5295d12e931db24381b7c94c72953\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ddb1b0d5d858584ed0d3a5aaa042ee693998c7e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:47:41+00:00",
      "cve": "CVE-2026-89733",
      "id": "CVE-2026-89733",
      "initial_release_date": "2026-09-11T19:46:42.613000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: USB UVC gadget driver use-after-free vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89733.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.