CVE-2026-89899media: cec: disable delayed work before freeing an interrupted transmit
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cec_transmit_msg_fh() drops adap->lock to wait for a blocking transmit in wait_for_completion_killable(). If that wait is interrupted by a signal, cancel_delayed_work_sync() can run before the CEC kthread arms the reply timeout via schedule_delayed_work(&data->work) in cec_transmit_done_ts(). The work is then armed after the cancel, and the data is freed with its delayed_work still pending: ODEBUG: free active (active state 0) object: ... hint: cec_wait_timeout Use disable_delayed_work_sync(): it cancels the work and disables it, so the later schedule_delayed_work() becomes a no-op and the work cannot be re-armed. The data is freed right after, so it need not be re-enabled.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 490d84f6d73c12f4204241cff8651eed60aae914 builds before 9a951931d4b4084acd64fa55fc3672a9da45ddf9; from 490d84f6d73c12f4204241cff8651eed60aae914 before a3adb63b121937b97f7fdc51e96564c7c799538b; 490d84f6d73c12f4204241cff8651eed60aae914 builds before 9c6ceb0949227c1f0cf0e19393daec72d9889871; 490d84f6d73c12f4204241cff8651eed60aae914 builds before 0fbd5c2327020858c45b2d1c65775d64cdeca523; e448dfd6d3ec944411f6575bc24e4f8baa1e297f; 2781b86d7e45de09befa5ace296b66787146561f; from 4.18.19 before 4.19; from 4.19.2 before 4.20 | CNA record |
References
- https://git.kernel.org/stable/c/9a951931d4b4084acd64fa55fc3672a9da45ddf9
- https://git.kernel.org/stable/c/a3adb63b121937b97f7fdc51e96564c7c799538b
- https://git.kernel.org/stable/c/9c6ceb0949227c1f0cf0e19393daec72d9889871
- https://git.kernel.org/stable/c/0fbd5c2327020858c45b2d1c65775d64cdeca523
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.