Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-89891

media: em28xx: fix use-after-free of dev_next->devlist on disconnect

No CVSS scoreEPSS 0.0022 · 12th percentile

Published by the CVE Program (CNA: Linux) at 16 Sept 2026, 10:31 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected f410b4093fdd4d8f4644d3d486afe3040eceef7b to before f61720346fdcc1a2deec59a2f6cbb0cc20d1dc18 git
  • affected f410b4093fdd4d8f4644d3d486afe3040eceef7b to before 1ed575b1991f68569eb589b7747d3bc26aa6a8a2 git
  • affected f410b4093fdd4d8f4644d3d486afe3040eceef7b to before da4b07da6281e39ce4c01e1227e036f3bf600e14 git
  • affected f410b4093fdd4d8f4644d3d486afe3040eceef7b to before 20aacd87550be297dc39a3f9532dcfff91586510 git
  • affected f410b4093fdd4d8f4644d3d486afe3040eceef7b to before 20c2c65f3d9f7c278dc9750531d3201ac8bf78b7 git
  • affected f410b4093fdd4d8f4644d3d486afe3040eceef7b to before 0782807552b6aff41b4656c6c9076a3231d3e79d git
  • affected f410b4093fdd4d8f4644d3d486afe3040eceef7b to before 16cb1ee17e093175b4d9ae33202f68e5b108cca2 git
  • affected f410b4093fdd4d8f4644d3d486afe3040eceef7b to before 826915b6b65e2d3251e7248ea54289a22d748c84 git
Other versions: unaffected
Linux Linux
  • affected 4.17
  • unaffected before 4.17 semver
  • unaffected 5.10.270 to 5.10.*, inclusive semver
  • unaffected 5.15.221 to 5.15.*, inclusive semver
  • unaffected 6.1.188 to 6.1.*, inclusive semver
  • unaffected 6.6.157 to 6.6.*, inclusive semver
  • unaffected 6.12.110 to 6.12.*, inclusive semver
  • unaffected 6.18.51 to 6.18.*, inclusive semver
  • unaffected 7.2.5 to 7.2.*, inclusive semver
  • unaffected 7.3 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2026-89891
CNA
Linux
Tags
Published
16 Sept 2026
Updated
19 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

No source has published a CVSS score for this record yet.

  • CISA KEV Not listed.
  • EPSS 0.0022, the 12th percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 16 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.