EUVD-2026-80499
GHSA-2c95-6v37-x3vh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local device-node access (AV:L/PR:L) and a narrow signal-interrupt timing window (AC:H); impact is memory-corruption DoS (A:H) with minor integrity and no confidentiality.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
media: cec: disable delayed work before freeing an interrupted transmit
cec_transmit_msg_fh() drops adap->lock to wait for a blocking transmit in wait_for_completion_killable(). If that wait is interrupted by a signal, cancel_delayed_work_sync() can run before the CEC kthread arms the reply timeout via schedule_delayed_work(&data->work) in cec_transmit_done_ts(). The work is then armed after the cancel, and the data is freed with its delayed_work still pending:
ODEBUG: free active (active state 0) object: ... hint: cec_wait_timeout
Use disable_delayed_work_sync(): it cancels the work and disables it, so the later schedule_delayed_work() becomes a no-op and the work cannot be re-armed. The data is freed right after, so it need not be re-enabled.
AnalysisAI
A race condition in the Linux kernel HDMI-CEC core (drivers/media/cec) lets a local user who can open a CEC character device (/dev/cecN) free an in-flight transmit data structure while its delayed work item is still pending, corrupting kernel state and typically crashing the system. Exploitation requires a CEC-capable adapter, permission to the device node, and a signal delivered at a narrow timing window between cancel_delayed_work_sync() and the kthread's schedule_delayed_work(&data->work) in cec_transmit_done_ts() - no public exploit code has been identified at time of analysis, and the impact is a denial of service via the debugobjects 'free active' path rather than information disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to a CEC character device (/dev/cecN) on a system with functioning CEC adapter hardware, plus the ability to run a process that initiates a blocking CEC transmit via CEC_TRANSMIT. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a CWE-362 race condition in the Linux kernel HDMI-CEC core (drivers/media/cec) where an interrupted blocking transmit can free a data structure while its delayed_work is still pending/re-armed, tripping the debugobjects 'free active' path and corrupting kernel state - the practical impact is a crash/DoS, not disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.12.110, 6.18.51, or 7.2.5 (or 7.3-rc1 and later mainline), each of which carries the disable_delayed_work_sync() conversion; where a full kernel upgrade is not immediately possible, backport the stable commit for your branch from https://git.kernel.org/stable/c/9a951931d4b4084acd64fa55fc3672a9da45ddf9, https://git.kernel.org/stable/c/a3adb63b121937b97f7fdc51e96564c7c799538b, https://git.kernel.org/stable/c/9c6ceb0949227c1f0cf0e19393daec72d9889871, or https://git.kernel.org/stable/c/0fbd5c2327020858c45b2d1c65775d64cdeca523, and refer to the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-89899 for tracking. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux systems for CEC-capable HDMI adapters and check whether /dev/cecN nodes exist and are accessible to non-privileged users; where they are not required, disable the cec module or restrict device-node permissions to root as an immediate interim measure, and confirm kernel versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today