CVE-2026-89894

A flaw was found in the Linux kernel's cx231xx media driver. A local attacker can exploit this vulnerability by manipulating video and Vertical Blanking Interval (VBI) queue operations. This allows for a heap out-of-bounds write, which could lead to arbitrary code execution or a denial of service.

Red Hat has rated this Important severity flaw in the Linux kernel's cx231xx USB video capture (media) driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10 and in Red Hat In-Vehicle OS 2. The driver's vidioc_s_fmt_vid_cap() and vidioc_s_std() operations change device-wide geometry (dev->width / dev->norm) but only refuse the change when the video queue is busy. Because the VBI node shares those ioctl operations, a local attacker with access to the cx231xx device can allocate a small VBI videobuf2 plane and then enlarge dev->width or switch dev->norm through the video node while the VBI stream is running. cx231xx_do_vbi_copy() then recomputes the copy destination offset from the larger live geometry and memcpy()s device-delivered data past the end of the smaller, already allocated plane, producing a heap out-of-bounds write with an attacker-chosen offset. This kernel memory corruption can lead to privilege escalation, arbitrary code execution, or a system crash (denial of service). Red Hat Enterprise Linux 6, 7, and 8, including their kernel-rt builds, are not affected because the vulnerable code is not present in those kernels. Red Hat scores this flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), slightly lower than the upstream 7.8 score, because reliable exploitation requires precise manipulation of VBI queue geometry and device-delivered data in addition to local access to the video device. Fixes for the affected products are being pursued through the standard Red Hat update process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.