What is the CVSS score of CVE-2026-89893?

CVE-2026-89893 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Which versions of Linux Kernel are affected by CVE-2026-89893?

Linux hosts equipped with Conexant CX23885-based NetUP DVB conditional-access hardware carry a kernel use-after-free that a local low-privileged user could trigger to crash or corrupt the kernel…. A patch is available.

How to fix or mitigate CVE-2026-89893?

Within 24 hours, confirm the vendor-released kernel fix for CVE-2026-89893 is available in your distribution's update channel and identify every host with the cx23885 module loaded and NetUP CI hardware present by checking module load state and hardware inventory; until those hosts are patched, restrict local login and interactive access to trusted administrators and consider blacklisting or not auto-loading the cx23885 module on any system that does not require NetUP CI functionality, since no public exploit code exists this is a risk-reduction measure rather than an emergency. Within 7 days, deploy the vendor kernel patch to all confirmed affected hosts through your standard change process, scheduling the required reboot inside a maintenance window so that module unload, device unbind, and physical hot-unplug events occur while the fix is in place, and prioritize any host where untrusted or multi-tenant local users can log in. Within 30 days, verify patch deployment via kernel version reporting and configuration management, re-baseline the asset inventory for NetUP CI hardware, and formalize a procedure that prevents physical hot-unplug of the CI device during operation on any host still awaiting reboot, then close the finding with documented evidence of remediation.

Linux Kernel CVE-2026-89893

EUVD-2026-80493 HIGH

2026-09-16 Linux

GHSA-8263-vr49-mgcg

Denial Of Service Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Local-only teardown race (AV:L/AC:H); needs privileges to remove/unbind the device (PR:L); realistic impact is kernel crash (A:H) with possible corruption (I:L), no meaningful disclosure (C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 16:40 vuln.today

tag: Denial Of Service added

Metadata Corrected

Sep 16, 2026 - 16:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Sep 16, 2026 - 15:49 vuln.today

CVSS changed

Sep 16, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Sep 16, 2026 - 11:03 EUVD

CVE Published

Sep 16, 2026 - 10:31 cve.org

HIGH 7.8

CVE Published

Sep 16, 2026 - 10:31 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: cx23885: cancel NetUP CI work before teardown

netup_ci_exit() frees a netup_ci_state while its work item, netup_read_ci_status(), may still be pending or running on the system workqueue. The worker obtains the state with container_of() and dereferences it, so it must not outlive the state.

netup_ci_init() queues the initial status read, and CI GPIO interrupts subsequently queue the same work from netup_ci_slot_status(). During remove, cx23885_finidev() calls free_irq() before the CI device is unregistered. free_irq() prevents further IRQ handlers from running, but does not drain work queued previously, so the worker can run after netup_ci_exit() frees the state.

Call cancel_work_sync() before dvb_ca_en50221_release() and kfree().

This issue was found by an in-house static analysis tool.

AnalysisAI

A use-after-free in the Linux kernel's cx23885 media driver lets a local attacker with low privileges (CVSS PR:L) corrupt or crash the kernel by triggering a race during teardown of a Conexant CX23885-based NetUP DVB conditional-access (CI) device. The NetUP CI work item netup_read_ci_status() can still be pending or executing on the system workqueue when netup_ci_exit() frees the associated netup_ci_state, because the removal path calls free_irq() (which stops new interrupts but does not drain already-queued work) before the CI device is unregistered; the fix inserts cancel_work_sync() before dvb_ca_en50221_release() and kfree(). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires a host with the Conexant cx23885-based NetUP DVB card and its CI (CAM/EN50221) support in use, so that netup_ci_init()/CI GPIO interrupts have queued the netup_read_ci_status() work item. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a high-CVSS-but-low-real-risk issue in practice. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patches are available: upgrade to Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110 or 6.18.51 (or 7.2.5 / 7.3-rc1 on the newer streams), which contain the cancel_work_sync() fix referenced by the stable commits at https://git.kernel.org/stable/c/aaf76794b870b0f391eff339252a2e2e22f33a4a, https://git.kernel.org/stable/c/f7ff5adb63c1b277565afa54ccc0924d841b4a52, https://git.kernel.org/stable/c/140ecbcbf978fbe60f83f8d4f8b1199029a5c763, https://git.kernel.org/stable/c/ec82b0cf7f75fd95802592dcc9560fc7f529bba4, https://git.kernel.org/stable/c/5deec890ecfa04d21cfa9bb9a2fe5e9dc98db5c5, https://git.kernel.org/stable/c/bf3f49273d5bf6acbdad18ff44c01ffcf7a7a146, https://git.kernel.org/stable/c/99cd62b9b1c818d6d01a87be9a8e5796314150a2 and https://git.kernel.org/stable/c/4e143d662ca94888b494b2427fc9e34494eb933a; backporting the single cancel_work_sync() call before dvb_ca_en50221_release()/kfree() is a low-risk option for kernels outside those streams. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, confirm the vendor-released kernel fix for CVE-2026-89893 is available in your distribution's update channel and identify every host with the cx23885 module loaded and NetUP CI hardware present by checking module load state and hardware inventory; until those hosts are patched, restrict local login and interactive access to trusted administrators and consider blacklisting or not auto-loading the cx23885 module on any system that does not require NetUP CI functionality, since no public exploit code exists this is a risk-reduction measure rather than an emergency. …

Threat intelligence, references, and detailed analysis are available after sign-in.