CVE-2026-89893

A flaw was found in the Linux kernel's cx23885 NetUP CI driver. This use-after-free vulnerability occurs when the netup_ci_exit() function frees a netup_ci_state structure while a related work item may still be pending or running. A local attacker could exploit this by triggering the module's removal, leading to a dereference of freed memory. This could result in a system crash and a denial of service.

This vulnerability is evaluated as a Moderate impact issue for Red Hat Enterprise Linux because exploitation requires local system access and relies on the teardown of specialized Conexant CX23885 PCI hardware. The affected driver provides support for video capture and TV tuner cards that are typically absent in enterprise and cloud environments. Consequently, systems running standard enterprise workloads without this specific hardware attached are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.