CVE-2026-89893
Description
In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI work before teardown netup_ci_exit() frees a netup_ci_state while its work item, netup_read_ci_status(), may still be pending or running on the system workqueue. The worker obtains the state with container_of() and dereferences it, so it must not outlive the state. netup_ci_init() queues the initial status read, and CI GPIO interrupts subsequently queue the same work from netup_ci_slot_status(). During remove, cx23885_finidev() calls free_irq() before the CI device is unregistered. free_irq() prevents further IRQ handlers from running, but does not drain work queued previously, so the worker can run after netup_ci_exit() frees the state. Call cancel_work_sync() before dvb_ca_en50221_release() and kfree(). This issue was found by an in-house static analysis tool.
How to fix
- Linux Linuxaaf76794b870b0f391eff339252a2e2e22f33a4a, f7ff5adb63c1b277565afa54ccc0924d841b4a52, 140ecbcbf978fbe60f83f8d4f8b1199029a5c763, ec82b0cf7f75fd95802592dcc9560fc7f529bba4, 5deec890ecfa04d21cfa9bb9a2fe5e9dc98db5c5, bf3f49273d5bf6acbdad18ff44c01ffcf7a7a146, 99cd62b9b1c818d6d01a87be9a8e5796314150a2, 4e143d662ca94888b494b2427fc9e34494eb933a or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | c184dcd282337c09695a4c1761d7ac77fdc8fb7d ≤ v < aaf76794b870b0f391eff339252a2e2e22f33a4a, c184dcd282337c09695a4c1761d7ac77fdc8fb7d ≤ v < f7ff5adb63c1b277565afa54ccc0924d841b4a52, c184dcd282337c09695a4c1761d7ac77fdc8fb7d ≤ v < 140ecbcbf978fbe60f83f8d4f8b1199029a5c763, c184dcd282337c09695a4c1761d7ac77fdc8fb7d ≤ v < ec82b0cf7f75fd95802592dcc9560fc7f529bba4, c184dcd282337c09695a4c1761d7ac77fdc8fb7d ≤ v < 5deec890ecfa04d21cfa9bb9a2fe5e9dc98db5c5, c184dcd282337c09695a4c1761d7ac77fdc8fb7d ≤ v < bf3f49273d5bf6acbdad18ff44c01ffcf7a7a146, c184dcd282337c09695a4c1761d7ac77fdc8fb7d ≤ v < 99cd62b9b1c818d6d01a87be9a8e5796314150a2, c184dcd282337c09695a4c1761d7ac77fdc8fb7d ≤ v < 4e143d662ca94888b494b2427fc9e34494eb933a, 2.6.30 | aaf76794b870b0f391eff339252a2e2e22f33a4a, f7ff5adb63c1b277565afa54ccc0924d841b4a52, 140ecbcbf978fbe60f83f8d4f8b1199029a5c763, ec82b0cf7f75fd95802592dcc9560fc7f529bba4, 5deec890ecfa04d21cfa9bb9a2fe5e9dc98db5c5, bf3f49273d5bf6acbdad18ff44c01ffcf7a7a146, 99cd62b9b1c818d6d01a87be9a8e5796314150a2, 4e143d662ca94888b494b2427fc9e34494eb933a |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.