HIGH Introduced in 7.0
vpe RecoveryWork UAF
CVE-2026-89875
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: quiesce overflow recovery before freeing streams The VIP overflow recovery worker is armed from the hardirq handler when a FIFO overflow is detected, and the list-complete path looks the stream up through the VPDMA list private pointer. Both keep touching stream, port and device state; the recovery worker also resets the parser and VPDMA, repopulates the descriptor list, and re-enables the per-list IRQs. vip_stop_streaming() masks and clears the per-list IRQs, but it neither synchronizes the hardirq handler nor disables recovery_work. An overflow IRQ that has already queued recovery_work, or a list-complete IRQ in flight when the stream is torn down, can therefore still dereference the stream after its resources are released: the descriptor list is freed by vip_release_stream() on file release, and the stream itself by free_stream() on unbind/remove. Drain the recovery worker and the IRQ handler at both teardown points through a shared vip_quiesce_stream() helper, before any stream-owned resource is released. disable_work_sync() cancels pending recovery_work, drains a running instance, and raises its disable depth, so a subsequent schedule_work() issued by a racing IRQ handler is rejected at the workqueue scheduler: recovery_work cannot be requeued after disable_work_sync() takes effect. The worker may still re-enable the per-list IRQs before disable_work_sync() returns; disable_irqs() then masks those sources and synchronize_irq() waits for any in-flight handler that still dereferences stream state. In vip_stop_streaming() the helper runs before the parser is stopped, since a worker drained by disable_work_sync() may re-enable the parser before exiting and would otherwise undo the stop. recovery_work is created disabled and enabled in vip_start_streaming() before IRQs, pairing the enable with the teardown disable across the streaming lifecycle. This issue was found by an in-house static analysis tool and confirmed by manual code review.
02KernelScan AI Analysis
Risk summary
A race condition in the TI VIP video input driver allows a local user with access to the video device node to trigger a use-after-free by racing stream teardown against an in-flight interrupt or pending overflow recovery worker. The freed stream structure can be dereferenced by the worker or interrupt handler, leading to kernel memory corruption that is potentially exploitable for privilege escalation or a system crash. Systems without TI VPE hardware are unaffected.
Vulnerability analysis
The TI VIP driver's overflow recovery worker and interrupt handler can continue accessing a video stream's internal state after the stream has been torn down and its resources freed. During normal operation, a FIFO overflow detected in the hard interrupt handler queues a recovery work item that resets hardware and re-enables interrupts; the stop-streaming path masks interrupts but never synchronizes the handler or cancels the pending worker, so a racing interrupt or in-flight worker can dereference the already-freed stream structure. The fix introduces a shared teardown helper that first disables and drains the recovery worker so it cannot be requeued, then masks and synchronizes the interrupt sources to wait for any in-flight handler, all before releasing any stream-owned resources. The recovery worker is also created in a disabled state and only enabled when streaming begins, pairing its lifecycle with the streaming session. This race is reachable locally by any user who can open and stream from the VIP video device node on systems equipped with TI VPE hardware.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.0 | 7.2.5 | fd5b4a14c87b |
| mainline | 7.0 | 7.3 | aeaacc300144 |