CVE-2026-89892

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the em28xx media driver. The audio-only path registers extensions during the primary device probing process. On dual-TS boards, this occurs before dev next is created, causing a duplicate device to inherit is audio only and be independently inserted into the em28xx devlist. Since this list should only contain primary devices, the independently linked secondary device can be freed during a disconnect while its list node remains reachable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.