Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89893— media: cx23885: cancel NetUP CI work before teardown

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： media: cx23885：在拆除前取消 NetUP CI 的工作项 会释放 ，但其工作项 可能仍在系统工作队列中处于待处理或正在运行状态。该工作项通过 获取状态结构体指针并对其进行解引用，因此它必须在状态结构体被释放前完成执行，不能在其之后继续运行。 会队列化初始状态读取，随后 CI GPIO 中断会通过 再次队列化同一工作项。在设备移除过程中， 在 CI 设备注销之前调用 。 可以阻止后续的中断处理程序运行，但不会排空（drain）之前已入队的工作项，因此工作项可能在

CVSS 7.8 · High EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1611 · Escape to Host

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux c184dcd282337c09695a4c1761d7ac77fdc8fb7d< aaf76794b870b0f391eff339252a2e2e22f33a4a affected
c184dcd282337c09695a4c1761d7ac77fdc8fb7d< f7ff5adb63c1b277565afa54ccc0924d841b4a52 affected
c184dcd282337c09695a4c1761d7ac77fdc8fb7d< 140ecbcbf978fbe60f83f8d4f8b1199029a5c763 affected
c184dcd282337c09695a4c1761d7ac77fdc8fb7d< ec82b0cf7f75fd95802592dcc9560fc7f529bba4 affected
c184dcd282337c09695a4c1761d7ac77fdc8fb7d< 5deec890ecfa04d21cfa9bb9a2fe5e9dc98db5c5 affected
c184dcd282337c09695a4c1761d7ac77fdc8fb7d< bf3f49273d5bf6acbdad18ff44c01ffcf7a7a146 affected
c184dcd282337c09695a4c1761d7ac77fdc8fb7d< 99cd62b9b1c818d6d01a87be9a8e5796314150a2 affected
c184dcd282337c09695a4c1761d7ac77fdc8fb7d< 4e143d662ca94888b494b2427fc9e34494eb933a affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89893

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
media: cx23885: cancel NetUP CI work before teardown
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI work before teardown netup_ci_exit() frees a netup_ci_state while its work item, netup_read_ci_status(), may still be pending or running on the system workqueue. The worker obtains the state with container_of() and dereferences it, so it must not outlive the state. netup_ci_init() queues the initial status read, and CI GPIO interrupts subsequently queue the same work from netup_ci_slot_status(). During remove, cx23885_finidev() calls free_irq() before the CI device is unregistered. free_irq() prevents further IRQ handlers from running, but does not drain work queued previously, so the worker can run after netup_ci_exit() frees the state. Call cancel_work_sync() before dvb_ca_en50221_release() and kfree(). This issue was found by an in-house static analysis tool.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux c184dcd282337c09695a4c1761d7ac77fdc8fb7d ~ aaf76794b870b0f391eff339252a2e2e22f33a4a -
Linux Linux 2.6.30 -

II. Public POCs for CVE-2026-89893

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89893

请登录查看更多情报信息。

Other References for CVE-2026-89893 (8)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89930 9.3 CRITICAL KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89893

No comments yet

Leave a comment