CVE-2026-89899 (GCVE-0-2026-89899)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39
VLAI
Title
media: cec: disable delayed work before freeing an interrupted transmit
Summary
In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cec_transmit_msg_fh() drops adap->lock to wait for a blocking transmit in wait_for_completion_killable(). If that wait is interrupted by a signal, cancel_delayed_work_sync() can run before the CEC kthread arms the reply timeout via schedule_delayed_work(&data->work) in cec_transmit_done_ts(). The work is then armed after the cancel, and the data is freed with its delayed_work still pending: ODEBUG: free active (active state 0) object: ... hint: cec_wait_timeout Use disable_delayed_work_sync(): it cancels the work and disables it, so the later schedule_delayed_work() becomes a no-op and the work cannot be re-armed. The data is freed right after, so it need not be re-enabled.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 490d84f6d73c12f4204241cff8651eed60aae914 , < 9a951931d4b4084acd64fa55fc3672a9da45ddf9 (git)
Affected: 490d84f6d73c12f4204241cff8651eed60aae914 , < a3adb63b121937b97f7fdc51e96564c7c799538b (git)
Affected: 490d84f6d73c12f4204241cff8651eed60aae914 , < 9c6ceb0949227c1f0cf0e19393daec72d9889871 (git)
Affected: 490d84f6d73c12f4204241cff8651eed60aae914 , < 0fbd5c2327020858c45b2d1c65775d64cdeca523 (git)
Affected: e448dfd6d3ec944411f6575bc24e4f8baa1e297f (git)
Affected: 2781b86d7e45de09befa5ace296b66787146561f (git)
Affected: 4.18.19 , < 4.19 (semver)
Affected: 4.19.2 , < 4.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/cec/core/cec-adap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a951931d4b4084acd64fa55fc3672a9da45ddf9",
              "status": "affected",
              "version": "490d84f6d73c12f4204241cff8651eed60aae914",
              "versionType": "git"
            },
            {
              "lessThan": "a3adb63b121937b97f7fdc51e96564c7c799538b",
              "status": "affected",
              "version": "490d84f6d73c12f4204241cff8651eed60aae914",
              "versionType": "git"
            },
            {
              "lessThan": "9c6ceb0949227c1f0cf0e19393daec72d9889871",
              "status": "affected",
              "version": "490d84f6d73c12f4204241cff8651eed60aae914",
              "versionType": "git"
            },
            {
              "lessThan": "0fbd5c2327020858c45b2d1c65775d64cdeca523",
              "status": "affected",
              "version": "490d84f6d73c12f4204241cff8651eed60aae914",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e448dfd6d3ec944411f6575bc24e4f8baa1e297f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2781b86d7e45de09befa5ace296b66787146561f",
              "versionType": "git"
            },
            {
              "lessThan": "4.19",
              "status": "affected",
              "version": "4.18.19",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/cec/core/cec-adap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.18.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cec: disable delayed work before freeing an interrupted transmit\n\ncec_transmit_msg_fh() drops adap-\u003elock to wait for a blocking transmit in\nwait_for_completion_killable(). If that wait is interrupted by a signal,\ncancel_delayed_work_sync() can run before the CEC kthread arms the reply\ntimeout via schedule_delayed_work(\u0026data-\u003ework) in cec_transmit_done_ts().\nThe work is then armed after the cancel, and the data is freed with its\ndelayed_work still pending:\n\n  ODEBUG: free active (active state 0) object: ... hint: cec_wait_timeout\n\nUse disable_delayed_work_sync(): it cancels the work and disables it, so\nthe later schedule_delayed_work() becomes a no-op and the work cannot be\nre-armed. The data is freed right after, so it need not be re-enabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in cec_transmit_msg_fh(), reached only via the local CEC_TRANSMIT ioctl on /dev/cec* (cec_ioctl to cec_transmit). A CEC peer on the HDMI bus cannot signal-interrupt wait_for_completion_killable(), so this is Local, unlike CEC RX IRQ bugs scored Adjacent.\nAC:L - The attacker issues a blocking CEC_TRANSMIT with a reply timeout and signals their own thread so cancel_delayed_work_sync() races the CEC kthread arming data-\u003ework in cec_transmit_done_ts(). They control both sides and can retry; syzkaller triggered it.\nPR:L - cec_open() defaults to CEC_MODE_INITIATOR, and neither CEC_TRANSMIT nor CEC_ADAP_S_LOG_ADDRS calls capable(). Only raw mode needs CAP_SYS_RAWIO and monitor modes need CAP_NET_ADMIN, neither required here. Unprivileged users with /dev/cec (video group, uaccess, Android HDMI-CEC) can trigger it.\nUI:N - The attacker opens /dev/cec, configures logical addresses, issues the blocking transmit ioctl, and delivers a signal to their own process. No separate victim action is required.\nS:U - The use-after-free corrupts kernel heap (struct cec_data) in the host kernel. It does not cross a VM, IOMMU, or other separate security authority.\nC:H - cec_wait_timeout() runs on a kmalloc\u0027d struct cec_data after kfree(), so a sprayed replacement object yields an attacker-controlled adap pointer and list walks. Per kernel CNA guidance, use-after-free is High confidentiality.\nI:H - The delayed-work UAF lets the attacker spray struct cec_data and corrupt list_heads and the adapter mutex when cec_wait_timeout()/cec_data_cancel() run, enabling arbitrary write and control-flow hijack. Per kernel CNA guidance, use-after-free is High integrity.\nA:H - Freeing struct cec_data while its delayed_work is still pending causes cec_wait_timeout() to run on freed memory, producing a kernel oops or panic even without a full exploit. Per kernel CNA guidance, use-after-free is High availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:48.953Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a951931d4b4084acd64fa55fc3672a9da45ddf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3adb63b121937b97f7fdc51e96564c7c799538b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c6ceb0949227c1f0cf0e19393daec72d9889871"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fbd5c2327020858c45b2d1c65775d64cdeca523"
        }
      ],
      "title": "media: cec: disable delayed work before freeing an interrupted transmit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89899",
    "datePublished": "2026-09-16T10:31:59.589Z",
    "dateReserved": "2026-09-11T19:38:34.774Z",
    "dateUpdated": "2026-09-16T14:39:48.953Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89899",
      "date": "2026-09-25",
      "epss": "0.00175",
      "percentile": "0.06208"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T02:37:50.000Z",
      "cve": "CVE-2026-89899",
      "id": "msrc_CVE-2026-89899",
      "initial_release_date": "2026-09-17T01:08:04.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "media: cec: disable delayed work before freeing an interrupted transmit",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89899.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/cec/core/cec-adap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9a951931d4b4084acd64fa55fc3672a9da45ddf9",
                    "status": "affected",
                    "version": "490d84f6d73c12f4204241cff8651eed60aae914",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a3adb63b121937b97f7fdc51e96564c7c799538b",
                    "status": "affected",
                    "version": "490d84f6d73c12f4204241cff8651eed60aae914",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9c6ceb0949227c1f0cf0e19393daec72d9889871",
                    "status": "affected",
                    "version": "490d84f6d73c12f4204241cff8651eed60aae914",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0fbd5c2327020858c45b2d1c65775d64cdeca523",
                    "status": "affected",
                    "version": "490d84f6d73c12f4204241cff8651eed60aae914",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "e448dfd6d3ec944411f6575bc24e4f8baa1e297f",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "2781b86d7e45de09befa5ace296b66787146561f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4.19",
                    "status": "affected",
                    "version": "4.18.19",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "affected",
                    "version": "4.19.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/cec/core/cec-adap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.20"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cec: disable delayed work before freeing an interrupted transmit\n\ncec_transmit_msg_fh() drops adap-\u003elock to wait for a blocking transmit in\nwait_for_completion_killable(). If that wait is interrupted by a signal,\ncancel_delayed_work_sync() can run before the CEC kthread arms the reply\ntimeout via schedule_delayed_work(\u0026data-\u003ework) in cec_transmit_done_ts().\nThe work is then armed after the cancel, and the data is freed with its\ndelayed_work still pending:\n\n  ODEBUG: free active (active state 0) object: ... hint: cec_wait_timeout\n\nUse disable_delayed_work_sync(): it cancels the work and disables it, so\nthe later schedule_delayed_work() becomes a no-op and the work cannot be\nre-armed. The data is freed right after, so it need not be re-enabled."
          }
        ],
        "id": "CVE-2026-89899",
        "lastModified": "2026-09-16T15:18:16.183",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:58.767",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0fbd5c2327020858c45b2d1c65775d64cdeca523"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9a951931d4b4084acd64fa55fc3672a9da45ddf9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9c6ceb0949227c1f0cf0e19393daec72d9889871"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a3adb63b121937b97f7fdc51e96564c7c799538b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.