Executive brief
The Linux kernel's cx23885 media driver contains a use-after-free vulnerability in the NetUP CI (Common Interface) cleanup code. When the device is removed, a work queue task may still be running after the driver frees the associated data structure, causing a crash or potential code execution. This affects systems using NetUP Dual DVB-S2 CI television cards.
Technical details
The vulnerability is a use-after-free in the cx23885 driver's NetUP CI module. The function netup_ci_exit() frees the netup_ci_state structure without cancelling its pending work item (netup_read_ci_status()). The work item uses container_of() to obtain the state and dereferences it, so execution after deallocation causes a crash. The root cause is that cx23885_finidev() calls free_irq() before CI device unregistration, which stops new IRQs but does not drain queued work. The fix adds cancel_work_sync() before dvb_ca_en50221_release() and kfree(). Attack vector is local (device removal/module unload), no user interaction required. The patch was committed in July 2026 and applies to all stable kernel versions.
Affected products
- Linux Linux kernel all versions with cx23885 NetUP CI support (affects multiple stable branches)
Timeline
- 2026-09-16: disclosed: Reported and published on NVD
- 2026-07-20: patched: Patch committed upstream (4e143d662ca94888b494b2427fc9e34494eb933a)
- 2026-09-14: other: Patch merged to stable branches