CVE-2026-89899

Last refreshed2026-10-19

Status: UPDATED | Advisory ID: CVE-2026-89899

Key Details

CVE	CVE-2026-89899
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-19
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

media: cec: disable delayed work before freeing an interrupted transmit

cec_transmit_msg_fh() drops adap->lock to wait for a blocking transmit in

wait_for_completion_killable(). If that wait is interrupted by a signal,

cancel_delayed_work_sync() can run before the CEC kthread arms the reply

timeout via schedule_delayed_work(&data->work) in cec_transmit_done_ts().

The work is then armed after the cancel, and the data is freed with its

delayed_work still pending:

ODEBUG: free active (active state 0) object: ... hint: cec_wait_timeout

Use disable_delayed_work_sync(): it cancels the work and disables it, so

the later schedule_delayed_work() becomes a no-op and the work cannot be

re-armed. The data is freed right after, so it need not be re-enabled. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-89899
CVE	https://www.cve.org/CVERecord?id=CVE-2026-89899

Source

Reference

NVD

CVE