---
id: CVE-2026-89888
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: i2c: ov02a10: fix endpoint parsing use-after-free

  The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)
  immediately after allocating and parsing the en…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: i2c: ov02a10: fix endpoint parsing use-after-free

  The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)
  immediately after allocating and parsing the en…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 91807efbe8ec7f591085067d9f96a112e015274b <
    9de48ba68f56de9fe20ebd3f9728d22af25f9a91
  - >-
    Linux >= 91807efbe8ec7f591085067d9f96a112e015274b <
    8ddb3b69f67b0632ff3830da18de3e8dcaf5884b
  - >-
    Linux >= 91807efbe8ec7f591085067d9f96a112e015274b <
    4c2988bf1ad2753240a38db10ce23e87ec542f8f
  - >-
    Linux >= 91807efbe8ec7f591085067d9f96a112e015274b <
    213b2489130357c8d3e8d4fb2bdab88791ce3185
  - >-
    Linux >= 91807efbe8ec7f591085067d9f96a112e015274b <
    90f9b421fc6d4f2edab7521efdb1e58571468d33
  - >-
    Linux >= 91807efbe8ec7f591085067d9f96a112e015274b <
    6e13784452785cd8402b228bea53bc6a027ade84
  - >-
    Linux >= 91807efbe8ec7f591085067d9f96a112e015274b <
    94971ba0592ca77ec99b292226a4b398763315b8
  - Linux 5.11
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:15.367'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89888'
references:
  - url: 'https://git.kernel.org/stable/c/213b2489130357c8d3e8d4fb2bdab88791ce3185'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4c2988bf1ad2753240a38db10ce23e87ec542f8f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6e13784452785cd8402b228bea53bc6a027ade84'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8ddb3b69f67b0632ff3830da18de3e8dcaf5884b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/90f9b421fc6d4f2edab7521efdb1e58571468d33'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/94971ba0592ca77ec99b292226a4b398763315b8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9de48ba68f56de9fe20ebd3f9728d22af25f9a91'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.982Z'
epss: 0.00171
epssPercentile: 0.05676
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: i2c: ov02a10: fix endpoint parsing use-after-free

The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)
immediately after allocating and parsing the endpoint. However, it
subsequently calls fwnode_property_read_u32() using the same 'ep'
handle, leading to a potential use-after-free.

Additionally, reading the optional 'ovti,mipi-clock-voltage' property
used to overwrite the 'ret' variable. If the property was missing,
'ret' would become negative, and this failure code would be incorrectly
returned at the end of the function, causing probe to fail entirely.

Fix the use-after-free by moving fwnode_property_read_u32() before
the endpoint is parsed and freed. Avoid the error leak by not
assigning the result of fwnode_property_read_u32() to 'ret'.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.