---
id: CVE-2026-89734
title: 'usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()

  In uvcg_video_init(), if kthread_run_worker() fails,
  the error logged uses uvcg_err(), however, the…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-476
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f0bbfbd16b3b67106535299d6a9ca3a5565494a6 <
    dbe2762ae8e543b06c57f1ac6512b02fd3fd09b2
  - >-
    Linux >= f0bbfbd16b3b67106535299d6a9ca3a5565494a6 <
    d511e015d06767f52bb18d48371cab6d7cb88433
  - >-
    Linux >= f0bbfbd16b3b67106535299d6a9ca3a5565494a6 <
    5b1da38592efdc1a263d4c0353298cba19e9d6fc
  - Linux 6.13
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:51:47.513Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89734'
references:
  - url: 'https://git.kernel.org/stable/c/dbe2762ae8e543b06c57f1ac6512b02fd3fd09b2'
  - url: 'https://git.kernel.org/stable/c/d511e015d06767f52bb18d48371cab6d7cb88433'
  - url: 'https://git.kernel.org/stable/c/5b1da38592efdc1a263d4c0353298cba19e9d6fc'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89734.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89734'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532458'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89734'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89734'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89734.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00206
epssPercentile: 0.10612
ingestedAt: '2026-09-14T11:11:19.885Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()

In uvcg_video_init(), if kthread_run_worker() fails,
the error logged uses uvcg_err(), however, the pointer it uses:
video->uvc is not assigned at this point, triggering a null
pointer dereference. Fix this by directly using uvc->func which
is assigned already.

## Affected

- `Linux >= f0bbfbd16b3b67106535299d6a9ca3a5565494a6 < dbe2762ae8e543b06c57f1ac6512b02fd3fd09b2`
- `Linux >= f0bbfbd16b3b67106535299d6a9ca3a5565494a6 < d511e015d06767f52bb18d48371cab6d7cb88433`
- `Linux >= f0bbfbd16b3b67106535299d6a9ca3a5565494a6 < 5b1da38592efdc1a263d4c0353298cba19e9d6fc`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89734.json)