SB2026091755 - NULL pointer dereference in Linux kernel usb airspy driver
Published: September 17, 2026
Security Bulletin ID
SB2026091755
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) NULL pointer dereference (CVE-ID: CVE-2026-89901)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in the Airspy USB driver when closing a streaming device after it has been disconnected. A local user can close the streaming device after disconnection to cause a denial of service.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/155d0378ae0d6305cc4840583a6b42d2d0595bff
- https://git.kernel.org/stable/c/297fee023f46d771a844520675692ea089d80d9d
- https://git.kernel.org/stable/c/2f378dc45e685fc825d2dd08e7864666d6fcc009
- https://git.kernel.org/stable/c/6e4ea90fdc6608cd5fac342e146ab6ae15d430bc
- https://git.kernel.org/stable/c/75089cea32e5055773bd13116236d08fdc98678a
- https://git.kernel.org/stable/c/a9a8c37ddda9fa3687b142be9098e1c37b8faf35
- https://git.kernel.org/stable/c/c6749ac8f59cc80eb1b2d52f167fdf13e12655cc
- https://git.kernel.org/stable/c/c9081e2655188d2d134a741aec837dc70439d505