media: cx23885: cancel NetUP CI work before teardown (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.17 % · percentile 6 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI work before teardown netup_ci_exit() frees a netup_ci_state while its work item, netup_read_ci_status(), may still be pending or running on the system workqueue. The worker obtains the state with container_of() and dereferences it, so it must not outlive the state. netup_ci_init() queues the initial status read, and CI GPIO interrupts subsequently queue the same work from netup_ci_slot_status(). During remove, cx23885_finidev() calls free_irq() before the CI device is unregistered. free_irq() prevents further IRQ handlers from running, but does not drain work queued previously, so the worker can run after netup_ci_exit() frees the state. Call cancel_work_sync() before dvb_ca_en50221_release() and kfree(). This issue was found by an in-house static analysis tool.
References
- https://git.kernel.org/stable/c/aaf76794b870b0f391eff339252a2e2e22f33a4a
- https://git.kernel.org/stable/c/f7ff5adb63c1b277565afa54ccc0924d841b4a52
- https://git.kernel.org/stable/c/140ecbcbf978fbe60f83f8d4f8b1199029a5c763
- https://git.kernel.org/stable/c/ec82b0cf7f75fd95802592dcc9560fc7f529bba4
- https://git.kernel.org/stable/c/5deec890ecfa04d21cfa9bb9a2fe5e9dc98db5c5
- https://git.kernel.org/stable/c/bf3f49273d5bf6acbdad18ff44c01ffcf7a7a146
- https://git.kernel.org/stable/c/99cd62b9b1c818d6d01a87be9a8e5796314150a2
- https://git.kernel.org/stable/c/4e143d662ca94888b494b2427fc9e34494eb933a
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-80493
- GCVE · GCVE-0-2026-89893
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected c184dcd282337c09695a4c1761d7ac77fdc8fb7d < aaf76794b870b0f391eff339252a2e2e22f33a4a ; affected c184dcd282337c09695a4c1761d7ac77fdc8fb7d < f7ff5adb63c1b277565afa54ccc0924d841b4a52 ; affected c184dcd282337c09695a4c1761d7ac77fdc8fb7d < 140ecbcbf978fbe60f83f8d4f8b1199029a5c763 ; affected c184dcd282337c09695a4c1761d7ac77fdc8fb7d < ec82b0cf7f75fd95802592dcc9560fc7f529bba4 ; affected c184dcd282337c09695a4c1761d7ac77fdc8fb7d < 5deec890ecfa04d21cfa9bb9a2fe5e9dc98db5c5 ; affected c184dcd282337c09695a4c1761d7ac77fdc8fb7d < bf3f49273d5bf6acbdad18ff44c01ffcf7a7a146 |
| Linux · Linux | affected 2.6.30 ; unaffected 0 < 2.6.30 ; unaffected 5.10.270 ≤ 5.10.* ; unaffected 5.15.221 ≤ 5.15.* ; unaffected 6.1.188 ≤ 6.1.* ; unaffected 6.6.157 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |