# media: i2c: ov02a10: fix endpoint parsing use-after-free

CVE record · `CVE-2026-89888`

- **Identifiers:** `CVE-2026-89888`
- **State:** Confirmed
- **Severity:** CVSS 7.8 High
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 16 Sept 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 16 Sept 2026, 10:31 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `91807efbe8ec7f591085067d9f96a112e015274b to before 9de48ba68f56de9fe20ebd3f9728d22af25f9a91` (git)
  - affected: `91807efbe8ec7f591085067d9f96a112e015274b to before 8ddb3b69f67b0632ff3830da18de3e8dcaf5884b` (git)
  - affected: `91807efbe8ec7f591085067d9f96a112e015274b to before 4c2988bf1ad2753240a38db10ce23e87ec542f8f` (git)
  - affected: `91807efbe8ec7f591085067d9f96a112e015274b to before 213b2489130357c8d3e8d4fb2bdab88791ce3185` (git)
  - affected: `91807efbe8ec7f591085067d9f96a112e015274b to before 90f9b421fc6d4f2edab7521efdb1e58571468d33` (git)
  - affected: `91807efbe8ec7f591085067d9f96a112e015274b to before 6e13784452785cd8402b228bea53bc6a027ade84` (git)
  - affected: `91807efbe8ec7f591085067d9f96a112e015274b to before 94971ba0592ca77ec99b292226a4b398763315b8` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `5.11`
  - unaffected: `before 5.11` (semver)
  - unaffected: `5.15.221 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.188 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.157 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.110 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.51 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.5 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 7.8 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0016, the 5th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 16 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-89888](https://www.cve.org/CVERecord?id=CVE-2026-89888)
- [NVD: CVE-2026-89888](https://nvd.nist.gov/vuln/detail/CVE-2026-89888)

### References from the CNA

- <https://git.kernel.org/stable/c/9de48ba68f56de9fe20ebd3f9728d22af25f9a91>
- <https://git.kernel.org/stable/c/8ddb3b69f67b0632ff3830da18de3e8dcaf5884b>
- <https://git.kernel.org/stable/c/4c2988bf1ad2753240a38db10ce23e87ec542f8f>
- <https://git.kernel.org/stable/c/213b2489130357c8d3e8d4fb2bdab88791ce3185>
- <https://git.kernel.org/stable/c/90f9b421fc6d4f2edab7521efdb1e58571468d33>
- <https://git.kernel.org/stable/c/6e13784452785cd8402b228bea53bc6a027ade84>
- <https://git.kernel.org/stable/c/94971ba0592ca77ec99b292226a4b398763315b8>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-89888>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-89888/>. Everything for agents: <https://agentprime.io/llms.txt>.