CVE-2026-89872

media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link

State: Published
Severity: Not scored
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link

In v4l2_fwnode_parse_link(), the remote endpoint fwnode reference is acquired using fwnode_graph_get_remote_endpoint(). This reference is properly released in the error paths, but it is leaked on the success path.

Add the missing fwnode_handle_put() before returning 0 to prevent the reference leak.

[Sakari Ailus: Fix subject prefix and coding style a little.]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before c9b5238d173ee9b94dcaa2b34244ea89c8024febAffected ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before ccd8d1d80afab8b492a583ae81bfd295835bab2fAffected ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before d92dc4692834e04bc0ef1d0908589852050d1a66Affected ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before ef609b3ce456f021320fee2fb7e45094a3ccf232Affected ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before 578c4bfa28bf21458ecdde2fd3fc429475f34c10Affected ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before 3ced388b7908270529e5aa6d221840114b6c33bcAffected ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before 881aafb139520570fd3390bf9938d7098b7fbb99Affected ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before a6e86efd7f85e519bf48417f41923f8bd51f1597Affected
LinuxLinux	4.13Affected before 4.13Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before c9b5238d173ee9b94dcaa2b34244ea89c8024febAffected
ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before ccd8d1d80afab8b492a583ae81bfd295835bab2fAffected
ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before d92dc4692834e04bc0ef1d0908589852050d1a66Affected
ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before ef609b3ce456f021320fee2fb7e45094a3ccf232Affected
ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before 578c4bfa28bf21458ecdde2fd3fc429475f34c10Affected
ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before 3ced388b7908270529e5aa6d221840114b6c33bcAffected
ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before 881aafb139520570fd3390bf9938d7098b7fbb99Affected
ca50c197bd9610ea984cfc0dc6855f183cbb46f8 to before a6e86efd7f85e519bf48417f41923f8bd51f1597Affected

LinuxLinux

4.13Affected
before 4.13Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.