Look up another CVE · open CVE-2026-89893 in the interactive tracker
CVE-2026-89893
media: cx23885: cancel NetUP CI work before teardown
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem drivers/media. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-89893 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
netup_ci_exit() frees a netup_ci_state while its work item, netup_read_ci_status(), may still be pending or running on the system workqueue. The worker obtains the state with container_of() and dereferences it, so it must not outlive the state. netup_ci_init() queues the initial status read, and CI GPIO interrupts subsequently queue the same work from netup_ci_slot_status(). During remove, cx23885_finidev() calls free_irq() before the CI device is unregistered. free_irq() prevents further IRQ handlers from running, but does not drain work queued previously, so the worker can run after netup_ci_exit() frees the state. Call cancel_work_sync() before dvb_ca_en50221_release() and kfree(). This issue was found by an in-house static analysis tool.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/media/pci/cx23885/cimax2.c
- What this is
- MEDIA INPUT INFRASTRUCTURE (V4L/DVB)MAINTAINERS section matched on drivers/media/ · linux-media@vger.kernel.org · Maintained
- Kernel module
- cx23885
Check it on the machine
grep -w CONFIG_VIDEO_CX23885 /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w cx23885Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- trixieMnot built on amd64/cloud-amd64, arm64/cloud-arm64, armel/rpi
- forky, sid, bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_VIDEO_CX23885
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 5.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/media
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.30 | 5.10.270 | aaf76794b870 |
| 2.6.30 | 5.15.221 | f7ff5adb63c1 |
| 2.6.30 | 6.1.188 | 140ecbcbf978 |
| 2.6.30 | 6.6.157 | ec82b0cf7f75 |
| 2.6.30 | 6.12.110 | 5deec890ecfa |
| 2.6.30 | 6.18.51 | bf3f49273d5b |
| 2.6.30 | 7.2.5 | 99cd62b9b1c8 |
| 2.6.30 | 7.3 | 4e143d662ca9 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The use-after-free is reached only on local PCI teardown of the NetUP Dual DVB-S2 CI card (cx23885_finidev → cx23885_dvb_unregister → netup_ci_exit) via sysfs unbind/remove, rmmod, or local PCI hot-remove. No network, adjacent-network, or remote-peer path queues netup_read_ci_status or frees netup_ci_state.
- AC:LAttack complexity, low
- netup_ci_init() unconditionally schedule_work()s the status worker, and CAM GPIO IRQs re-queue it via netup_ci_slot_status(); an attacker who then unbinds/rebinds controls both sides of the missing cancel_work_sync race. The worker's 33-byte I2C transfer widens a retryable window, so this UAF is Low complexity.
- PR:LPrivileges required, low
- Per CNA driver-removal UAF precedent on this same NetUP PCIe DVB family (CVE-2023-53219), an unprivileged local video-group/uaccess user on broadcast, HTPC, or set-top systems can spray the freed netup_ci_state while teardown proceeds. Init-namespace root is not required for the UAF itself.
- UI:NUser interaction, none
- The attacker queues the CI work (driver bind or CAM GPIO) and initiates PCI unbind, rmmod, or hot-remove themselves. No separate victim action such as mounting a filesystem or opening attacker-supplied content is required.
- S:UScope, unchanged
- The use-after-free corrupts the host kernel netup_ci_state heap object and dvb_ca_en50221 private state within the same security authority. It is not a VM escape, IOMMU/DMA isolation bypass, or sandbox breakout.
- C:HConfidentiality impact, high
- After kfree(state), netup_read_ci_status recovers the object via container_of() and reads state->ca, i2c_adap, and status from freed memory. Spraying the slab turns this kernel heap UAF into an arbitrary read, which per UAF guidance is Confidentiality High.
- I:HIntegrity impact, high
- The dangling worker writes state->status/next_status_checked_time and calls dvb_ca_en50221_frda_irq(), which loads ca->pub->read_cam_control from the freed object, a heap-spray function-pointer hijack. UAF memory corruption is scored Integrity High.
- A:HAvailability impact, high
- Use-after-free of netup_ci_state from workqueue context after kfree, or a NULL deref of ca->private if the worker interleaves dvb_ca_en50221_release, oopses or panics the kernel even when not fully exploited, so availability impact is High.