Executive brief
The Linux kernel's HDMI CEC (Consumer Electronics Control) media framework contains a race condition in how it handles exclusive message delivery to follower processes. When the kernel processes incoming CEC messages, it may read follower state without proper synchronization, potentially leading to use-after-free conditions or message delivery to freed memory. This could cause kernel crashes or undefined behavior on systems with HDMI CEC devices.
Technical details
The vulnerability is a race condition (CWE-362) in the cec_receive_notify() function within drivers/media/cec/core/cec-adap.c. The function reads the exclusive follower pointer (adap->cec_follower) without holding the adapter's mutex lock, creating a window where concurrent mode changes or resource release could invalidate the pointer before it is used. An attacker or local unprivileged process with access to a CEC device interface could trigger this race by rapidly modifying follower state while messages are being processed, potentially causing a use-after-free condition. The fix adds mutex locking around the follower pointer checks and message delivery operations. Patches are available in the upstream Linux kernel and stable branches.
Affected products
- Linux Linux kernel 2.6.11 through 6.x and later (all versions prior to fix commit 1924d0788caa6c66fd320dd4704fae99487fd2c7)
Timeline
- 2026-09-16: disclosed: CVE-2026-89897 published
- 2026-07-08: patched: Fix committed by Ruoyu Wang; backported to stable branches as commit 271e57a936dcdbaecb4b1bd005d9a285bbe60ab4