CVE-2026-89894
Description
A flaw was found in the Linux kernel's cx231xx media driver. A local attacker can exploit this vulnerability by manipulating video and Vertical Blanking Interval (VBI) queue operations. This allows for a heap out-of-bounds write, which could lead to arbitrary code execution or a denial of service.
Statement
Red Hat has rated this Important severity flaw in the Linux kernel's cx231xx USB video capture (media) driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10 and in Red Hat In-Vehicle OS 2. The driver's vidioc_s_fmt_vid_cap() and vidioc_s_std() operations change device-wide geometry (dev->width / dev->norm) but only refuse the change when the video queue is busy. Because the VBI node shares those ioctl operations, a local attacker with access to the cx231xx device can allocate a small VBI videobuf2 plane and then enlarge dev->width or switch dev->norm through the video node while the VBI stream is running. cx231xx_do_vbi_copy() then recomputes the copy destination offset from the larger live geometry and memcpy()s device-delivered data past the end of the smaller, already allocated plane, producing a heap out-of-bounds write with an attacker-chosen offset. This kernel memory corruption can lead to privilege escalation, arbitrary code execution, or a system crash (denial of service). Red Hat Enterprise Linux 6, 7, and 8, including their kernel-rt builds, are not affected because the vulnerable code is not present in those kernels. Red Hat scores this flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), slightly lower than the upstream 7.8 score, because reliable exploitation requires precise manipulation of VBI queue geometry and device-delivered data in addition to local access to the video device. Fixes for the affected products are being pursued through the standard Red Hat update process.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
