---
id: CVE-2026-89886
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: intel/ipu6: fix async notifier cleanup leak on parse error

  isys_notifier_init() calls v4l2_async_nf_init() and then adds fwnode
  remote subdevs in a loop with v4…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: intel/ipu6: fix async notifier cleanup leak on parse error

  isys_notifier_init() calls v4l2_async_nf_init() and then adds fwnode
  remote subdevs in a loop with v4…
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f50c4ca0a82003b8a542c3332fd292cf1bc355a2 <
    dd5943aedbe4d7eb46158cb35078257733ac48b6
  - >-
    Linux >= f50c4ca0a82003b8a542c3332fd292cf1bc355a2 <
    27b7997be552ee37b3e01beacfeb4131f1bebb5f
  - >-
    Linux >= f50c4ca0a82003b8a542c3332fd292cf1bc355a2 <
    eee6069e4e9511e814a33a75e403f7e863f70394
  - >-
    Linux >= f50c4ca0a82003b8a542c3332fd292cf1bc355a2 <
    abb1f808ceab5a3275f8a6b4e37cff17f9f781c1
  - Linux 6.10
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T11:16:57.100'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89886'
references:
  - url: 'https://git.kernel.org/stable/c/27b7997be552ee37b3e01beacfeb4131f1bebb5f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/abb1f808ceab5a3275f8a6b4e37cff17f9f781c1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dd5943aedbe4d7eb46158cb35078257733ac48b6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eee6069e4e9511e814a33a75e403f7e863f70394'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89886.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89886'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2535154'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89886'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89886'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89886.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-09-16T10:53:53.982Z'
epss: 0.00209
epssPercentile: 0.09761
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-772
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: intel/ipu6: fix async notifier cleanup leak on parse error

isys_notifier_init() calls v4l2_async_nf_init() and then adds fwnode
remote subdevs in a loop with v4l2_async_nf_add_fwnode_remote(). If an
endpoint parse or add fails partway through the loop, it jumps to
err_parse and returns without calling v4l2_async_nf_cleanup(), leaking
every v4l2_async_connection already added to the notifier's waiting
list.

The register-failure path just below already cleans up correctly, and
the caller only tears the notifier down (isys_notifier_cleanup()) once
isys_notifier_init() has returned success. Clean up the notifier on the
parse error path too.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89886.json)