CVE-2026-89901

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the airspy driver. The airspy disconnect() function clears the s->udev variable while holding the v4l2 lock. However, if a user closes the device after it has been disconnected, the airspy stop streaming() function is executed, which unconditionally calls airspy ctrl msg() and airspy free stream bufs(). Both of these functions attempt to access s->udev, leading to a crash because the pointer is already NULL. Specifically, the crash occurs within usb sndctrlpipe() and usb free coherent() when they attempt to use the s->udev variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.