CVE-2026-89733

The Linux kernel's USB Video Class (UVC) gadget driver (f_uvc) fails to NULL the uvc->control_req and uvc->control_buf pointers after freeing them in the error path of uvc_function_bind() and in uvc_function_unbind(), leaving dangling pointers and a use-after-free condition. A local attacker with low privileges who can trigger a gadget bind failure or an unbind/rebind sequence (for example, tearing down or reconfiguring a configfs-based USB gadget) could cause the kernel to act on freed memory, potentially escalating privileges to root with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). Only systems that actually enable the UVC gadget function are exposed — typically embedded Linux devices configured to present themselves as USB webcams — since standard desktop and server distributions do not enable this driver by default. No public proof-of-concept exists, the flaw is not in CISA's KEV catalog, and no exploitation is known to be occurring.

What to do: Apply kernel updates that include the f_uvc dangling-pointer fix and reboot affected devices. Verify exposure by checking whether the usb_f_uvc module is loaded or CONFIG_USB_CONFIGFS_F_UVC is enabled (e.g., lsmod | grep usb_f_uvc); if the UVC gadget function is not needed, disable or blacklist the module. On embedded devices that do use it, restrict which users/processes can unbind and rebind gadget functions and monitor kernel logs for oopses referencing uvc_function_bind or uvc_function_unbind.