CVE-2026-89734

What it actually does

Null pointer dereference occurs in uvcg_video_init() when kthread_run_worker() fails because the error path dereferences video->uvc before it has been assigned.

Why it matters to the business

Systems relying on USB gadget UVC functionality may experience kernel instability or crashes during device initialization under error conditions, potentially disrupting connected hardware operation and requiring reboots.

How an attack unfolds

An attacker triggers the specific error path in uvcg_video_init() where kthread_run_worker() returns failure before the uvc pointer is set, causing the kernel to dereference a null pointer and panic.

How to fix it

Apply the upstream kernel patch that replaces the erroneous uvcg_err() call with direct use of the already-assigned uvc->func pointer; rebuild and deploy the fixed kernel image.

How to confirm the fix worked

Inspect the uvcg_video_init() function in the kernel source to confirm the error logging line no longer references video->uvc and instead uses uvc->func; test initialization failure paths in a controlled environment.

Typical attack path

1. Gain ability to load or interact with the UVC gadget driver in the Linux kernel
2. Force or wait for kthread_run_worker() to fail during uvcg_video_init()
3. Observe or induce kernel panic from the resulting null dereference

How to detect it

Search kernel logs and crash dumps for oops traces originating from uvcg_video_init() or references to null pointer usage in the UVC gadget initialization path.

What your security team should do

• Prioritize patching kernel images on all systems exposing USB gadget UVC functionality
• Monitor for kernel oops or panic logs containing references to uvcg_video_init
• Limit exposure of USB gadget interfaces to trusted contexts until patched