Cloudanix VulnDB

CVE-2026-93101

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the way the operating system cleans up certain video devices when they are unplugged can make the computer crash.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free condition in v4l2-async sub-device handling when asc_list is empty, causing v4l2_device_unregister_subdev to be skipped during device disconnect and leaving dangling references.

Why it matters to the business

Unexpected system crashes when disconnecting certain USB video capture devices, leading to loss of availability for affected hardware and potential data loss during active capture sessions.

How an attack unfolds

An attacker with physical or local access triggers repeated connect/disconnect cycles of a legacy em28xx-based device using the tvp5150 driver; the empty asc_list path bypasses proper unregistration, leaving a freed sub-device structure that can be referenced later to achieve a use-after-free.

How to fix it

Apply the upstream kernel patch that ensures v4l2_device_unregister_subdev is called regardless of asc_list state; rebuild and deploy the fixed kernel image to all affected systems.

How to confirm the fix worked

Confirm the presence of the commit that adds the asc_list-empty check before calling unregister; test by connecting and disconnecting the affected device type and verifying no crash or kernel oops occurs.

Typical attack path

  1. Attach a compatible USB video device that uses the legacy driver path
  2. Trigger v4l2_async registration of the sub-device
  3. Perform abrupt device disconnect while the asc_list remains empty
  4. Reuse or reference the dangling sub-device structure to trigger the use-after-free

How to detect it

Search kernel logs and dmesg output for oops or panic messages referencing v4l2_async_unregister_subdev or tvp5150 around the time of USB device removal events.

What your security team should do

  • Prioritize patching kernel packages on systems that use v4l2 media drivers
  • Restrict physical access to USB ports on high-value hosts until patched
  • Monitor kernel logs for v4l2-async related oops messages after any device changes

The record

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: Unregister sub-device if asc_list is empty When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes. The cause is that the tvp5150 i2c module uses v4l2_async, but the em28xx driver does not since it predates v4l2_async. In that corner case sd->asc_list is empty, so v4l2_async_unregister_subdev() never calls v4l2_device_unregister_subdev(). Modify the code so that, if sd->asc_list is empty, v4l2_device_unregister_subdev() is still called.

Affected packages

Ecosystem Package Introduced Fixed