HIGH Introduced in 5.11
ov02a10 Endpoint UAF
CVE-2026-89888
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov02a10: fix endpoint parsing use-after-free The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint. However, it subsequently calls fwnode_property_read_u32() using the same 'ep' handle, leading to a potential use-after-free. Additionally, reading the optional 'ovti,mipi-clock-voltage' property used to overwrite the 'ret' variable. If the property was missing, 'ret' would become negative, and this failure code would be incorrectly returned at the end of the function, causing probe to fail entirely. Fix the use-after-free by moving fwnode_property_read_u32() before the endpoint is parsed and freed. Avoid the error leak by not assigning the result of fwnode_property_read_u32() to 'ret'.
02KernelScan AI Analysis
Risk summary
A use-after-free in the OV02A10 image sensor driver's hardware configuration parsing can be triggered during device probe. An attacker who can control device tree or firmware node properties for this sensor could exploit this to cause memory corruption, potentially leading to privilege escalation or denial of service.
Vulnerability analysis
During device probe, the OV02A10 sensor driver parses a firmware endpoint node and releases it immediately, then reads an optional property from the already-freed node handle, resulting in a use-after-free. The fix moves the optional property read before the endpoint is parsed and freed, and stops overwriting the function's return value with the optional property lookup result so that a missing property no longer causes probe to fail. The vulnerable path is reached when the kernel probes an OV02A10 image sensor, which requires the sensor to be present on an I2C bus and described in the device tree or ACPI tables; an attacker would need to control the firmware node properties supplied to the driver, typically requiring physical access to modify device tree or bootloader configuration, or root-level access to load a device tree overlay.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.11 | 5.15.221 | 9de48ba68f56 |
| 6.1 | 5.11 | 6.1.188 | 8ddb3b69f67b |
| 6.12 | 5.11 | 6.12.110 | 213b24891303 |
| 6.18 | 5.11 | 6.18.51 | 90f9b421fc6d |
| 6.6 | 5.11 | 6.6.157 | 4c2988bf1ad2 |
| 7.2 | 5.11 | 7.2.5 | 6e1378445278 |
| mainline | 5.11 | 7.3 | 94971ba0592c |
| cip/6.1 | 5.11 | 6.1.189-cip61 | 8ddb3b69f67b |
| cip/6.1-rt | 5.11 | 6.1.189-cip61-rt32 | 8ddb3b69f67b |
| cip/6.12 | 5.11 | 6.12.111-cip32 | 213b24891303 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |