CVE-2026-89899

A flaw was found in the Linux kernel's Consumer Electronics Control (CEC) subsystem. This vulnerability occurs when a transmit operation is interrupted, leading to a delayed work item remaining active after its associated data has been freed. A local attacker could potentially exploit this use-after-free condition to cause a denial of service or potentially achieve arbitrary code execution.

A race in the CEC transmit path can leave a delayed_work item armed after its containing transmit data object is freed. cec_transmit_msg_fh drops adap lock while waiting in wait_for_completion_killable, and if a signal interrupts the wait, cancel_delayed_work_sync can run before the CEC kthread schedules the reply timeout work. The work can then be scheduled after cancellation and later run cec_wait_timeout on freed memory, making this a use after free candidate rather than a simple warning. For the CVSS the PR:L is used because a local user or process with access to a CEC device node can attempt the transmit and signal interruption path. The issue is not network reachable. Impact is at least local denial of service via kernel crash, and in the paranoid interpretation may include confidentiality or integrity impact due to the pending work using freed kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.