CVE-2026-89898

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

extron_process_received() hex-decodes Ceci/Ceco lines the Extron DA HD 4K Plus reports from its HDMI ports over USB-serial; a malicious HDMI-CEC source on the same splitter bus (conference-room laptop, signage player) can supply those frames, with a USB gadget impersonating the Extron only an extra physical path.

AC:LAttack complexity, low

A crafted Ceci/Ceco line of more than 16 %XX triplets deterministically writes past msg.msg[16]; the attacker fully controls the HDMI-CEC or USB-serial payload, and no race or attacker-uncontrollable memory layout is required.

PR:NPrivileges required, none

HDMI-CEC and the Extron USB-serial reports are parsed in extron_interrupt() with no host authentication; an adjacent HDMI device or malicious USB ACM gadget needs no account or capability on the Linux host.

UI:NUser interaction, none

Once the Extron is bound via serport, incoming serial lines are parsed automatically in the interrupt handler; an already-connected HDMI source can trigger the overflow without a victim opening a file or clicking.

S:UScope, unchanged

The overflow corrupts only the host kernel that runs this CEC USB driver and does not cross a VM, IOMMU, or other separate security authority.

C:HConfidentiality impact, high

Attacker-chosen hex bytes are written past the 16-byte on-stack msg.msg[] array (a 256-byte line yields up to ~82 decoded bytes), corrupting kernel stack contents and enabling disclosure of adjacent kernel memory.

I:HIntegrity impact, high

The same out-of-bounds stores smash the kernel stack frame, including saved control data and the return address, enabling control-flow hijacking and arbitrary kernel writes.

A:HAvailability impact, high

Overflowing the on-stack cec_msg produces a kernel oops or panic from stack-canary abort or corrupted control data, so the host can be crashed at will.