Executive brief
The Linux kernel's Consumer Electronics Control (CEC) subsystem contains a race condition that can lead to a use-after-free vulnerability when transmitting messages. If a signal interrupts a CEC transmit operation, the kernel may free memory that still has a pending timer scheduled, causing the system to access freed data. This could potentially crash the kernel or allow privilege escalation on systems with CEC hardware (some TVs, video capture cards, and HDMI devices).
Technical details
The vulnerability exists in the media/cec subsystem's cec_transmit_msg_fh() function. When a blocking CEC transmit is interrupted by a signal, the function releases its lock and calls wait_for_completion_killable(). Due to a race condition, cancel_delayed_work_sync() may be called before the CEC kthread has scheduled the reply timeout via schedule_delayed_work() in cec_transmit_done_ts(). The delayed work is then armed after cancellation, and the data structure is freed while the delayed_work is still pending, triggering a use-after-free. The fix replaces cancel_delayed_work_sync() with disable_delayed_work_sync(), which disables the work to prevent re-arming after cancellation. The vulnerability requires CEC hardware or module to be present and the ability to trigger interrupted CEC transmit operations via signals.
Affected products
- Linux Linux kernel all versions (patched from 2026-09-14 onwards)
Timeline
- 2026-09-16: disclosed: CVE-2026-89899 published
- 2026-06-21: patched: Upstream fix commit 0fbd5c2327020858c45b2d1c65775d64cdeca523
- 2026-09-14: patched: Merged into stable kernel