CVE-2026-89897media: cec: Serialize exclusive follower delivery
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: cec: Serialize exclusive follower delivery cec_receive_notify() reads the exclusive follower pointer without the adapter lock. Serialize the no-follower check and message delivery against mode changes and release.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 before efc829b4b937f98c4467bffe9243f756b7cfbf7f; from 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 before cac577854826950dda4d53569728b1da6c1425d5; 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 builds before 4b532b271c91790b7ab661cd488a7ad36f5c4f6b; 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 builds before 271e57a936dcdbaecb4b1bd005d9a285bbe60ab4; from 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 before df941e6851da17fc53c7f6af2bdcc7383d17babc; 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 builds before 5c62095acc2a952099688774513c4a637bcdb2b5; from 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 before ae614f48712156fb0f55b207338d48d422c58bc0; 9881fe0ca187c213eb3a6a8e78e45ad4d1cec171 builds before 1924d0788caa6c66fd320dd4704fae99487fd2c7 | CNA record |
References
- https://git.kernel.org/stable/c/efc829b4b937f98c4467bffe9243f756b7cfbf7f
- https://git.kernel.org/stable/c/cac577854826950dda4d53569728b1da6c1425d5
- https://git.kernel.org/stable/c/4b532b271c91790b7ab661cd488a7ad36f5c4f6b
- https://git.kernel.org/stable/c/271e57a936dcdbaecb4b1bd005d9a285bbe60ab4
- https://git.kernel.org/stable/c/df941e6851da17fc53c7f6af2bdcc7383d17babc
- https://git.kernel.org/stable/c/5c62095acc2a952099688774513c4a637bcdb2b5
- https://git.kernel.org/stable/c/ae614f48712156fb0f55b207338d48d422c58bc0
- https://git.kernel.org/stable/c/1924d0788caa6c66fd320dd4704fae99487fd2c7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.