HIGH Introduced in 4.8
cec ExclusiveFollower Race
CVE-2026-89897
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: media: cec: Serialize exclusive follower delivery cec_receive_notify() reads the exclusive follower pointer without the adapter lock. Serialize the no-follower check and message delivery against mode changes and release.
02KernelScan AI Analysis
Risk summary
A race condition in the Linux kernel's HDMI CEC framework allows a local attacker to trigger use-after-free or other memory corruption by concurrently changing the exclusive follower mode while CEC messages are being delivered. The bug is reachable from a local process with access to the CEC device node, and exploitation could lead to privilege escalation or denial of service.
Vulnerability analysis
The CEC message delivery path reads the exclusive follower pointer without holding the necessary lock, so a concurrent thread that changes the follower mode or releases the follower can free that object while it is still being used to queue an incoming message. The fix serializes both the no-follower check and the message delivery under the same lock, preventing the pointer from changing underneath the delivery path. The vulnerable code is reachable from a local process that can open and configure a CEC device node, which on systems with HDMI CEC hardware and the CEC subsystem loaded requires only ordinary device-node access permissions.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.8 | 5.10.270 | efc829b4b937 |
| 5.15 | 4.8 | 5.15.221 | cac577854826 |
| 6.1 | 4.8 | 6.1.188 | 4b532b271c91 |
| 6.12 | 4.8 | 6.12.110 | df941e6851da |
| 6.18 | 4.8 | 6.18.51 | 5c62095acc2a |
| 6.6 | 4.8 | 6.6.157 | 271e57a936dc |
| 7.2 | 4.8 | 7.2.5 | ae614f487121 |
| mainline | 4.8 | 7.3 | 1924d0788caa |
| cip/5.10 | 4.8 | 5.10.271-cip78 | efc829b4b937 |
| cip/6.1 | 4.8 | 6.1.189-cip61 | 4b532b271c91 |
| cip/6.1-rt | 4.8 | 6.1.189-cip61-rt32 | 4b532b271c91 |
| cip/6.12 | 4.8 | 6.12.111-cip32 | df941e6851da |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |