media: cec: disable delayed work before freeing an interrupted transmit
Summary
| CVE | CVE-2026-89899 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-16 11:16:58 UTC |
| Updated | 2026-09-16 15:18:16 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cec_transmit_msg_fh() drops adap->lock to wait for a blocking transmit in wait_for_completion_killable(). If that wait is interrupted by a signal, cancel_delayed_work_sync() can run before the CEC kthread arms the reply timeout via schedule_delayed_work(&data->work) in cec_transmit_done_ts(). The work is then armed after the cancel, and the data is freed with its delayed_work still pending: ODEBUG: free active (active state 0) object: ... hint: cec_wait_timeout Use disable_delayed_work_sync(): it cancels the work and disables it, so the later schedule_delayed_work() becomes a no-op and the work cannot be re-armed. The data is freed right after, so it need not be re-enabled. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 490d84f6d73c12f4204241cff8651eed60aae914 9a951931d4b4084acd64fa55fc3672a9da45ddf9 git | Not specified |
| CNA | Linux | Linux | affected 490d84f6d73c12f4204241cff8651eed60aae914 a3adb63b121937b97f7fdc51e96564c7c799538b git | Not specified |
| CNA | Linux | Linux | affected 490d84f6d73c12f4204241cff8651eed60aae914 9c6ceb0949227c1f0cf0e19393daec72d9889871 git | Not specified |
| CNA | Linux | Linux | affected 490d84f6d73c12f4204241cff8651eed60aae914 0fbd5c2327020858c45b2d1c65775d64cdeca523 git | Not specified |
| CNA | Linux | Linux | affected e448dfd6d3ec944411f6575bc24e4f8baa1e297f git | Not specified |
| CNA | Linux | Linux | affected 2781b86d7e45de09befa5ace296b66787146561f git | Not specified |
| CNA | Linux | Linux | affected 4.18.19 4.19 semver | Not specified |
| CNA | Linux | Linux | affected 4.19.2 4.20 semver | Not specified |
| CNA | Linux | Linux | affected 4.20 | Not specified |
| CNA | Linux | Linux | unaffected 4.20 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.110 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.51 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2.5 7.2.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.3-rc1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/9a951931d4b4084acd64fa55fc3672a9da45ddf9 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/9c6ceb0949227c1f0cf0e19393daec72d9889871 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/a3adb63b121937b97f7fdc51e96564c7c799538b | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/0fbd5c2327020858c45b2d1c65775d64cdeca523 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.