{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89886", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.773Z", "datePublished": "2026-09-16T10:31:50.497Z", "dateUpdated": "2026-10-19T08:54:19.350Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:54:19.350Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: intel/ipu6: fix async notifier cleanup leak on parse error\n\nisys_notifier_init() calls v4l2_async_nf_init() and then adds fwnode\nremote subdevs in a loop with v4l2_async_nf_add_fwnode_remote(). If an\nendpoint parse or add fails partway through the loop, it jumps to\nerr_parse and returns without calling v4l2_async_nf_cleanup(), leaking\nevery v4l2_async_connection already added to the notifier's waiting\nlist.\n\nThe register-failure path just below already cleans up correctly, and\nthe caller only tears the notifier down (isys_notifier_cleanup()) once\nisys_notifier_init() has returned success. Clean up the notifier on the\nparse error path too."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/pci/intel/ipu6/ipu6-isys.c"], "versions": [{"version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2", "lessThan": "dd5943aedbe4d7eb46158cb35078257733ac48b6", "status": "affected", "versionType": "git"}, {"version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2", "lessThan": "27b7997be552ee37b3e01beacfeb4131f1bebb5f", "status": "affected", "versionType": "git"}, {"version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2", "lessThan": "eee6069e4e9511e814a33a75e403f7e863f70394", "status": "affected", "versionType": "git"}, {"version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2", "lessThan": "abb1f808ceab5a3275f8a6b4e37cff17f9f781c1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/pci/intel/ipu6/ipu6-isys.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dd5943aedbe4d7eb46158cb35078257733ac48b6"}, {"url": "https://git.kernel.org/stable/c/27b7997be552ee37b3e01beacfeb4131f1bebb5f"}, {"url": "https://git.kernel.org/stable/c/eee6069e4e9511e814a33a75e403f7e863f70394"}, {"url": "https://git.kernel.org/stable/c/abb1f808ceab5a3275f8a6b4e37cff17f9f781c1"}], "title": "media: intel/ipu6: fix async notifier cleanup leak on parse error", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/pci/intel/ipu6/ipu6-isys.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dd5943aedbe4d7eb46158cb35078257733ac48b6", "status": "affected", "version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2", "versionType": "git"}, {"lessThan": "27b7997be552ee37b3e01beacfeb4131f1bebb5f", "status": "affected", "version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2", "versionType": "git"}, {"lessThan": "eee6069e4e9511e814a33a75e403f7e863f70394", "status": "affected", "version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2", "versionType": "git"}, {"lessThan": "abb1f808ceab5a3275f8a6b4e37cff17f9f781c1", "status": "affected", "version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/pci/intel/ipu6/ipu6-isys.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: intel/ipu6: fix async notifier cleanup leak on parse error\n\nisys_notifier_init() calls v4l2_async_nf_init() and then adds fwnode\nremote subdevs in a loop with v4l2_async_nf_add_fwnode_remote(). If an\nendpoint parse or add fails partway through the loop, it jumps to\nerr_parse and returns without calling v4l2_async_nf_cleanup(), leaking\nevery v4l2_async_connection already added to the notifier's waiting\nlist.\n\nThe register-failure path just below already cleans up correctly, and\nthe caller only tears the notifier down (isys_notifier_cleanup()) once\nisys_notifier_init() has returned success. Clean up the notifier on the\nparse error path too."}], "id": "CVE-2026-89886", "lastModified": "2026-10-19T09:18:33.563", "metrics": {}, "published": "2026-09-16T11:16:57.100", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/27b7997be552ee37b3e01beacfeb4131f1bebb5f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/abb1f808ceab5a3275f8a6b4e37cff17f9f781c1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd5943aedbe4d7eb46158cb35078257733ac48b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eee6069e4e9511e814a33a75e403f7e863f70394"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: media: intel/ipu6: fix async notifier cleanup leak on parse error", "id": "2535154", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535154"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmedia: intel/ipu6: fix async notifier cleanup leak on parse error\nisys_notifier_init() calls v4l2_async_nf_init() and then adds fwnode\nremote subdevs in a loop with v4l2_async_nf_add_fwnode_remote(). If an\nendpoint parse or add fails partway through the loop, it jumps to\nerr_parse and returns without calling v4l2_async_nf_cleanup(), leaking\nevery v4l2_async_connection already added to the notifier's waiting\nlist.\nThe register-failure path just below already cleans up correctly, and\nthe caller only tears the notifier down (isys_notifier_cleanup()) once\nisys_notifier_init() has returned success. Clean up the notifier on the\nparse error path too.", "A flaw was found in the Intel IPU6 media driver within the Linux kernel. This vulnerability occurs when the driver fails to properly clean up resources during an error in processing device connections. An attacker could potentially exploit this by triggering a specific error condition, leading to a resource leak. This continuous resource depletion could ultimately result in a Denial of Service (DoS), making the system unresponsive or unstable."], "name": "CVE-2026-89886", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89886\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89886\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89886.mbox"], "threat_severity": "Low"}