What is the CVSS score of EUVD-2026-80499?

EUVD-2026-80499 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Which versions of Linux Kernel are affected by EUVD-2026-80499?

A race condition in the Linux kernel's HDMI-CEC subsystem can let a local user with access to a CEC device node crash affected systems, causing unplanned outages and service disruption on any host…. A patch is available.

How to fix or mitigate EUVD-2026-80499?

Within 24 hours, inventory Linux systems for CEC-capable HDMI adapters and check whether /dev/cecN nodes exist and are accessible to non-privileged users; where they are not required, disable the cec module or restrict device-node permissions to root as an immediate interim measure, and confirm kernel versions in use. Within 7 days, schedule upgrades to the vendor-released kernel versions - 6.12.110, 6.18.51, or 7.2.5 (or 7.3-rc1 for those tracking the release-candidate line) - prioritizing any host that has CEC hardware exposed to interactive or untrusted local users, and verify post-upgrade that the previous CEC device permissions have not been silently reverted. Within 30 days, complete remediation across the remaining estate, fold CEC hardware presence into the standard kernel patch-tracking process so future media-subsystem flaws are triaged with the same speed, and document the compensating control of removing or restricting /dev/cecN access on any system that cannot yet be patched.

Linux Kernel EUVD-2026-80499

| CVE-2026-89899 HIGH

2026-09-16 Linux

GHSA-2c95-6v37-x3vh

Denial Of Service Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Local device-node access (AV:L/PR:L) and a narrow signal-interrupt timing window (AC:H); impact is memory-corruption DoS (A:H) with minor integrity and no confidentiality.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 16:40 vuln.today

tag: Denial Of Service added

Metadata Corrected

Sep 16, 2026 - 16:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Sep 16, 2026 - 15:50 vuln.today

CVSS changed

Sep 16, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Sep 16, 2026 - 11:03 EUVD

CVE Published

Sep 16, 2026 - 10:31 cve.org

HIGH 7.8

CVE Published

Sep 16, 2026 - 10:31 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: cec: disable delayed work before freeing an interrupted transmit

cec_transmit_msg_fh() drops adap->lock to wait for a blocking transmit in wait_for_completion_killable(). If that wait is interrupted by a signal, cancel_delayed_work_sync() can run before the CEC kthread arms the reply timeout via schedule_delayed_work(&data->work) in cec_transmit_done_ts(). The work is then armed after the cancel, and the data is freed with its delayed_work still pending:

ODEBUG: free active (active state 0) object: ... hint: cec_wait_timeout

Use disable_delayed_work_sync(): it cancels the work and disables it, so the later schedule_delayed_work() becomes a no-op and the work cannot be re-armed. The data is freed right after, so it need not be re-enabled.

AnalysisAI

A race condition in the Linux kernel HDMI-CEC core (drivers/media/cec) lets a local user who can open a CEC character device (/dev/cecN) free an in-flight transmit data structure while its delayed work item is still pending, corrupting kernel state and typically crashing the system. Exploitation requires a CEC-capable adapter, permission to the device node, and a signal delivered at a narrow timing window between cancel_delayed_work_sync() and the kthread's schedule_delayed_work(&data->work) in cec_transmit_done_ts() - no public exploit code has been identified at time of analysis, and the impact is a denial of service via the debugobjects 'free active' path rather than information disclosure. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires local access to a CEC character device (/dev/cecN) on a system with functioning CEC adapter hardware, plus the ability to run a process that initiates a blocking CEC transmit via CEC_TRANSMIT. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a CWE-362 race condition in the Linux kernel HDMI-CEC core (drivers/media/cec) where an interrupted blocking transmit can free a data structure while its delayed_work is still pending/re-armed, tripping the debugobjects 'free active' path and corrupting kernel state - the practical impact is a crash/DoS, not disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to Linux 6.12.110, 6.18.51, or 7.2.5 (or 7.3-rc1 and later mainline), each of which carries the disable_delayed_work_sync() conversion; where a full kernel upgrade is not immediately possible, backport the stable commit for your branch from https://git.kernel.org/stable/c/9a951931d4b4084acd64fa55fc3672a9da45ddf9, https://git.kernel.org/stable/c/a3adb63b121937b97f7fdc51e96564c7c799538b, https://git.kernel.org/stable/c/9c6ceb0949227c1f0cf0e19393daec72d9889871, or https://git.kernel.org/stable/c/0fbd5c2327020858c45b2d1c65775d64cdeca523, and refer to the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-89899 for tracking. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory Linux systems for CEC-capable HDMI adapters and check whether /dev/cecN nodes exist and are accessible to non-privileged users; where they are not required, disable the cec module or restrict device-node permissions to root as an immediate interim measure, and confirm kernel versions in use. …

Threat intelligence, references, and detailed analysis are available after sign-in.