CVE-2026-89897 (GCVE-0-2026-89897)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39
VLAI
Title
media: cec: Serialize exclusive follower delivery
Summary
In the Linux kernel, the following vulnerability has been resolved: media: cec: Serialize exclusive follower delivery cec_receive_notify() reads the exclusive follower pointer without the adapter lock. Serialize the no-follower check and message delivery against mode changes and release.
Severity
7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 , < efc829b4b937f98c4467bffe9243f756b7cfbf7f (git)
Affected: 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 , < cac577854826950dda4d53569728b1da6c1425d5 (git)
Affected: 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 , < 4b532b271c91790b7ab661cd488a7ad36f5c4f6b (git)
Affected: 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 , < 271e57a936dcdbaecb4b1bd005d9a285bbe60ab4 (git)
Affected: 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 , < df941e6851da17fc53c7f6af2bdcc7383d17babc (git)
Affected: 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 , < 5c62095acc2a952099688774513c4a637bcdb2b5 (git)
Affected: 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 , < ae614f48712156fb0f55b207338d48d422c58bc0 (git)
Affected: 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 , < 1924d0788caa6c66fd320dd4704fae99487fd2c7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/cec/core/cec-adap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "efc829b4b937f98c4467bffe9243f756b7cfbf7f",
              "status": "affected",
              "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
              "versionType": "git"
            },
            {
              "lessThan": "cac577854826950dda4d53569728b1da6c1425d5",
              "status": "affected",
              "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
              "versionType": "git"
            },
            {
              "lessThan": "4b532b271c91790b7ab661cd488a7ad36f5c4f6b",
              "status": "affected",
              "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
              "versionType": "git"
            },
            {
              "lessThan": "271e57a936dcdbaecb4b1bd005d9a285bbe60ab4",
              "status": "affected",
              "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
              "versionType": "git"
            },
            {
              "lessThan": "df941e6851da17fc53c7f6af2bdcc7383d17babc",
              "status": "affected",
              "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
              "versionType": "git"
            },
            {
              "lessThan": "5c62095acc2a952099688774513c4a637bcdb2b5",
              "status": "affected",
              "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
              "versionType": "git"
            },
            {
              "lessThan": "ae614f48712156fb0f55b207338d48d422c58bc0",
              "status": "affected",
              "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
              "versionType": "git"
            },
            {
              "lessThan": "1924d0788caa6c66fd320dd4704fae99487fd2c7",
              "status": "affected",
              "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/cec/core/cec-adap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cec: Serialize exclusive follower delivery\n\ncec_receive_notify() reads the exclusive follower pointer without the\nadapter lock. Serialize the no-follower check and message delivery\nagainst mode changes and release."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - cec_receive_notify() runs from cec_received_msg_ts() on HDMI-CEC frames a peer places on the shared CEC line. HDMI-CEC is a multi-drop bus among TVs, AVRs, streaming sticks, and conference or automotive HDMI sources, matching CAN/Bluetooth adjacent-segment scoring rather than Internet-routable Network.\nAC:H - The use-after-free requires cec_release() to kfree the exclusive-follower cec_fh after the unlocked pointer load in cec_receive_notify(). A CEC peer can flood receive but cannot close that filehandle, so success depends on concurrent local teardown the attacker cannot initiate.\nPR:N - HDMI-CEC has no authentication. Any device on the same CEC bus can emit frames that the adapter delivers into cec_received_msg_ts() with no Linux account, capability, or user-namespace check on the host.\nUI:N - Once the adapter is configured and receiving, which is normal for TVs, Android HDMI-CEC, SBCs, and automotive head units that claim a logical address at boot, RX delivery and any concurrent follower close run without a mount, prompt, or other interactive victim step.\nS:U - The use-after-free is of the kmalloc\u0027d struct cec_fh inside the host kernel CEC core and does not cross a VM, IOMMU, or other separate security-authority boundary.\nC:H - After cec_release() kfree()s the exclusive follower, cec_queue_msg_fh() still locks and walks lists on the dangling cec_fh. That kernel heap use-after-free enables disclosure of reused object contents.\nI:H - cec_queue_msg_fh() writes the freed filehandle via mutex operations, list_add_tail of a new cec_msg_entry, and wake_up_interruptible, a heap use-after-free write and control-flow hijack primitive.\nA:H - Using a freed cec_fh from the receive path causes a kernel oops or panic even when not fully exploited for code execution, taking down the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:46.418Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/efc829b4b937f98c4467bffe9243f756b7cfbf7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cac577854826950dda4d53569728b1da6c1425d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b532b271c91790b7ab661cd488a7ad36f5c4f6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/271e57a936dcdbaecb4b1bd005d9a285bbe60ab4"
        },
        {
          "url": "https://git.kernel.org/stable/c/df941e6851da17fc53c7f6af2bdcc7383d17babc"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c62095acc2a952099688774513c4a637bcdb2b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae614f48712156fb0f55b207338d48d422c58bc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/1924d0788caa6c66fd320dd4704fae99487fd2c7"
        }
      ],
      "title": "media: cec: Serialize exclusive follower delivery",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89897",
    "datePublished": "2026-09-16T10:31:58.184Z",
    "dateReserved": "2026-09-11T19:38:34.773Z",
    "dateUpdated": "2026-09-16T14:39:46.418Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89897",
      "date": "2026-09-25",
      "epss": "0.00357",
      "percentile": "0.26728"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T02:17:32.000Z",
      "cve": "CVE-2026-89897",
      "id": "msrc_CVE-2026-89897",
      "initial_release_date": "2026-09-17T01:13:34.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "media: cec: Serialize exclusive follower delivery",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89897.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/cec/core/cec-adap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "efc829b4b937f98c4467bffe9243f756b7cfbf7f",
                    "status": "affected",
                    "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cac577854826950dda4d53569728b1da6c1425d5",
                    "status": "affected",
                    "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4b532b271c91790b7ab661cd488a7ad36f5c4f6b",
                    "status": "affected",
                    "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "271e57a936dcdbaecb4b1bd005d9a285bbe60ab4",
                    "status": "affected",
                    "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "df941e6851da17fc53c7f6af2bdcc7383d17babc",
                    "status": "affected",
                    "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5c62095acc2a952099688774513c4a637bcdb2b5",
                    "status": "affected",
                    "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ae614f48712156fb0f55b207338d48d422c58bc0",
                    "status": "affected",
                    "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1924d0788caa6c66fd320dd4704fae99487fd2c7",
                    "status": "affected",
                    "version": "9881fe0ca187c213eb3a6a8e78e45ad4d1cec171",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/cec/core/cec-adap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.8"
                  },
                  {
                    "lessThan": "4.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cec: Serialize exclusive follower delivery\n\ncec_receive_notify() reads the exclusive follower pointer without the\nadapter lock. Serialize the no-follower check and message delivery\nagainst mode changes and release."
          }
        ],
        "id": "CVE-2026-89897",
        "lastModified": "2026-09-16T15:18:15.943",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:58.533",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1924d0788caa6c66fd320dd4704fae99487fd2c7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/271e57a936dcdbaecb4b1bd005d9a285bbe60ab4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4b532b271c91790b7ab661cd488a7ad36f5c4f6b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5c62095acc2a952099688774513c4a637bcdb2b5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ae614f48712156fb0f55b207338d48d422c58bc0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cac577854826950dda4d53569728b1da6c1425d5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/df941e6851da17fc53c7f6af2bdcc7383d17babc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/efc829b4b937f98c4467bffe9243f756b7cfbf7f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.