CVE-2026-89897

A flaw was found in the Linux kernel's media subsystem, specifically within the Consumer Electronics Control (CEC) framework. The cec_receive_notify() function reads the exclusive follower pointer without proper locking, creating a race condition. This lack of serialization during exclusive follower delivery and message handling against mode changes could lead to inconsistent state or unexpected behavior, potentially resulting in a denial of service.

A race in the HDMI CEC receive path can occur because cec_receive_notify reads and uses the exclusive follower pointer without holding the adapter lock. A local user with access to the CEC device can race follower mode changes or filehandle release against incoming CEC message delivery, which may result in a stale cec_follower pointer and a possible use after free. For the CVSS the PR:L is used because reliable triggering requires local access to the CEC device node or an equivalent local process context, not just remote packet delivery. The issue is not reachable over normal IP networking. It is limited to systems with a CEC adapter and exposed CEC userspace access, often tied to HDMI connected devices. Impact is at least local denial of service via kernel crash and in the paranoid case may include confidentiality or integrity impact because the bug class is a race with a plausible UAF during object release.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.