CVE-2026-89899

In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cectransmitmsgfh drops adap-lock to wait for a blocking transmit in waitforcompletionkillable. If that wait is interrupted by a signal, canceldelayedworksync...

CVE-2026-89900

CVE-2026-89900 is a kernel memory leak in the Linux kernel's media/cec/core subsystem. A prior commit that fixed a race condition between unregister and urb/irq callbacks removed the implicit call to rc_free_device() from rc_unregister_device() but failed to remove the NULL assignment of adap-&gt...

EUVD-2026-80500

In the Linux kernel, the following vulnerability has been resolved: media: cec: core: Fix kmemleak due to missed rcfreedevice call The commit dccc0c3ddf8f "media: rc: fix race between unregister and urb/irq callbacks" removed the implicit call to rcfreedevice from rcunregisterdevice. However, the...

CVE-2026-89899 media: cec: disable delayed work before freeing an interrupted transmit

In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cectransmitmsgfh drops adap-lock to wait for a blocking transmit in waitforcompletionkillable. If that wait is interrupted by a signal, canceldelayedworksync...

CVE-2026-89899

CVE-2026-89899 is a race condition in the Linux kernel's CEC (Consumer Electronics Control) media subsystem . In cec_transmit_msg_fh(), the adapter lock is dropped to wait for a blocking transmit; if that wait is interrupted by a signal, cancel_delayed_work_sync() can execute before the CEC kthre...

CVE-2026-89897

CVE-2026-89897 affects the Linux kernel 's CEC (Consumer Electronics Control) media subsystem. The vulnerability resides in cec_receive_notify(), which reads the exclusive follower pointer without holding the adapter lock , creating a race condition. The fix serializes the no-follower check and m...

EUVD-2026-80497

In the Linux kernel, the following vulnerability has been resolved: media: cec: Serialize exclusive follower delivery cecreceivenotify reads the exclusive follower pointer without the adapter lock. Serialize the no-follower check and message delivery against mode changes and release...

CVE-2026-89898 media: cec: extron-da-hd-4k-plus: add sanity check

In the Linux kernel, the following vulnerability has been resolved: media: cec: extron-da-hd-4k-plus: add sanity check Add check to prevent overflowing msg.msg in case the incoming data is malformed...

CECster

CECSTeR CECSTeR is the Consumer Electronics Control Security Testing Resource - a GUI-based tool to perform security testing against the HDMI CEC Consumer Electronics Control and HEC HDMI Ethernet Channel protocols Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm: bridge: adv7511: Unregistering the i2c device after unregistering the CEC adapter. The cecunregisteradapter function assumes that the underlying CEC adapter is callable. For example, if the CEC adapter currently has a valid...

UBUNTU-CVE-2026-89725

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...

CVE-2026-89725

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...

Linux Distros Unpatched Vulnerability : CVE-2026-89725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index,...

CVE-2026-89725

A flaw was found in the Linux kernel's media: cec: stm32 driver. A remote attacker can exploit an out-of-bounds write vulnerability by sending an overlong Consumer Electronics Control CEC message without an end-of-message signal. This causes the driver to write beyond an allocated buffer,...

DEBIAN-CVE-2026-89725

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...

CVE-2026-89725

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...

EUVD-2026-76637

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...

CVE-2026-89725 media: cec: stm32: prevent out-of-bounds write on RX overflow

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...

CVE-2026-89725

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...

CVE-2026-89725 media: cec: stm32: prevent out-of-bounds write on RX overflow

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...