Executive brief
The Linux kernel's VPE (Video Processing Engine) driver for TI hardware contains a race condition where stream cleanup can occur while the overflow recovery worker is still running. This allows attackers with local access to trigger a use-after-free vulnerability, leading to kernel crashes or potential code execution on systems using affected TI video processing hardware.
Technical details
The vulnerability is a use-after-free race condition in the TI VPE (Video Processing Engine) VPDMA driver's media subsystem. The VIP overflow recovery worker is armed from a hardirq handler when a FIFO overflow is detected, but vip_stop_streaming() does not synchronize with or cancel the recovery worker before releasing stream resources. When a stream is torn down, the descriptor list and stream structure can be freed while the overflow recovery worker or list-complete IRQ handler is still executing, leading to a use-after-free dereference. The fix implements a shared vip_quiesce_stream() helper that uses disable_work_sync() to drain the recovery worker and prevent requeue, followed by disable_irqs() and synchronize_irq() to quiesce the interrupt handlers before any stream resources are released. This ensures proper synchronization across the streaming lifecycle.
Affected products
- Linux Linux kernel multiple versions prior to fix
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory: CVE-2026-89875 published on NVD