EUVD-2026-80488
GHSA-4c55-f2c6-f257
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local probe/device-tree-parse path (AV:L), depends on a reallocation race and specific hardware/firmware (AC:H); benign read in practice (C:N) with at most transient probe-failure DoS (I:L/A:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
media: i2c: ov02a10: fix endpoint parsing use-after-free
The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint. However, it subsequently calls fwnode_property_read_u32() using the same 'ep' handle, leading to a potential use-after-free.
Additionally, reading the optional 'ovti,mipi-clock-voltage' property used to overwrite the 'ret' variable. If the property was missing, 'ret' would become negative, and this failure code would be incorrectly returned at the end of the function, causing probe to fail entirely.
Fix the use-after-free by moving fwnode_property_read_u32() before the endpoint is parsed and freed. Avoid the error leak by not assigning the result of fwnode_property_read_u32() to 'ret'.
AnalysisAI
Use-after-free in the Linux kernel's ov02a10 MIPI CSI-2 sensor driver (media: i2c) can abort or destabilize driver probe on systems that physically include an OmniVision OV02A10 camera together with a firmware/device-tree description that binds that driver. The ov02a10_check_hwcfg() function calls fwnode_handle_put() on the parsed endpoint and then reads the optional 'ovti,mipi-clock-voltage' property through the same stale handle, while also letting the failure code from that optional property overwrite the function's return value, so probe can fail even when nothing else is wrong. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a system that physically includes the OmniVision OV02A10 MIPI CSI-2 camera sensor and a firmware/device-tree description that binds the ov02a10 driver, so the flaw only fires in ov02a10_check_hwcfg() during driver probe (boot or module load). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is LOW despite the vendor's 7.8 (HIGH) rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 or 7.3-rc1 (or a later release in the same series), which carry the corrected ov02a10_check_hwcfg() ordering and return-code handling; distribution kernels should adopt the equivalent backports, for example the stable commits at https://git.kernel.org/stable/c/9de48ba68f56de9fe20ebd3f9728d22af25f9a91, https://git.kernel.org/stable/c/8ddb3b69f67b0632ff3830da18de3e8dcaf5884b, https://git.kernel.org/stable/c/4c2988bf1ad2753240a38db10ce23e87ec542f8f, https://git.kernel.org/stable/c/213b2489130357c8d3e8d4fb2bdab88791ce3185, https://git.kernel.org/stable/c/90f9b421fc6d4f2edab7521efdb1e58571468d33, https://git.kernel.org/stable/c/6e13784452785cd8402b228bea53bc6a027ade84 and https://git.kernel.org/stable/c/94971ba0592ca77ec99b292226a4b398763315b8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, determine which managed Linux assets run kernel 5.11 or later and physically contain an OmniVision OV02A10 MIPI CSI-2 sensor with a firmware or device tree that binds the ov02a10 driver, using hardware inventory and device-tree/firmware records to narrow the scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today