CVE-2026-89725: Linux Kernel CEC Buffer Overflow Vulnerability

CVE-2026-89725 Overview

CVE-2026-89725 is an out-of-bounds write vulnerability in the Linux kernel's STMicroelectronics STM32 Consumer Electronics Control (CEC) driver. The flaw resides in stm32_rx_done(), which appends each received CEC byte to the fixed-size rx_msg.msg[] buffer without validating the write index against the buffer size. A peer CEC device that keeps transmitting bytes without ending the message can drive the RXBR interrupt repeatedly, pushing rx_msg.len beyond the 16-byte CEC_MAX_MSG_SIZE and corrupting adjacent kernel memory. The vulnerability was found using the CodeQL static analysis tool.

Critical Impact
An adjacent-network attacker with access to the CEC bus can trigger a kernel-memory out-of-bounds write without local privileges, enabling potential memory corruption, denial of service, or code execution.

Affected Products

Linux kernel builds including the stm32-cec media driver
STMicroelectronics STM32 platforms exposing HDMI-CEC functionality
Downstream distributions and embedded firmware shipping the affected driver prior to the fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89725 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89725

Vulnerability Analysis

The STM32 CEC driver handles received bytes inside the stm32_rx_done() interrupt path. Each RXBR (receive-byte-ready) event stores a byte into rx_msg.msg[] using rx_msg.len as both the index and a post-increment counter. The driver code performs the assignment cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF; with no bounds check. rx_msg.len is only reset when the hardware raises RXACKE, RXOVR, or after RXEND marks message completion. Because the end-of-message flag is controlled by the remote CEC peer through the EOM bit, a hostile transmitter can withhold RXEND indefinitely.

Root Cause

The root cause is missing input validation on a hardware-driven length counter, classified as an out-of-bounds write. The rx_msg structure embeds a 16-byte msg[] array sized by CEC_MAX_MSG_SIZE. The CEC core validates length only on the consumer side, after the byte has already been written. This ordering means the core length check cannot prevent overflow inside the driver's IRQ thread. Peer-controlled bytes therefore spill into memory adjacent to rx_msg in kernel space.

Attack Vector

Exploitation requires a device on the same CEC bus, typically an HDMI-connected sink or source. Once the driver has probed and receiving is enabled, no additional authentication or local privilege is needed. A malicious CEC peer transmits an overlong frame that continually asserts RXBR without setting EOM. Each additional byte extends rx_msg.len past the 16-byte boundary, writing attacker-supplied data into surrounding kernel objects. The bytes written are fully controlled by the peer, giving an attacker influence over the corrupted memory contents.

The upstream fix bounds the index in the driver before the store, dropping excess bytes from overlong frames. This matches the pattern used by other platform CEC drivers such as tegra_cec. Refer to the kernel commit fb9dda3 and related backports for the exact remediation.

Detection Methods for CVE-2026-89725

Indicators of Compromise

Unexpected kernel oops, panic, or KASAN/slab-out-of-bounds reports referencing stm32_rx_done or stm32_cec_irq_thread.
Abnormal CEC bus traffic where a peer transmits frames longer than 16 bytes without asserting EOM.
Unexplained reboots or driver resets on STM32-based devices with HDMI-CEC enabled.

Detection Strategies

Enable CONFIG_KASAN on test builds to catch out-of-bounds writes in stm32-cec during fuzzing or peer-device testing.
Correlate dmesg entries containing stm32-cec with adjacent CEC frame anomalies captured via bus logic analyzers.
Inventory kernel versions across STM32 fleets and flag hosts running builds prior to the fix commits referenced in the NVD entry.

Monitoring Recommendations

Forward kernel logs from STM32 devices into a centralized log pipeline and alert on stm32_rx_done warnings or crash signatures.
Track CEC device pairings on managed displays and identify unrecognized peers appearing on the bus.
Monitor firmware and kernel patch levels in configuration management to confirm affected images are retired.

How to Mitigate CVE-2026-89725

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry to all STM32 devices exposing CEC.
Where patching is not immediately possible, disable the stm32-cec module on systems that do not require HDMI-CEC.
Restrict physical or logical access to HDMI interfaces on affected embedded devices in shared or public environments.

Patch Information

The fix adds a bounds check on rx_msg.len before writing the received byte into rx_msg.msg[], dropping excess bytes from overlong CEC frames. The change is distributed across multiple stable branches, including commits fb9dda3, 0c260d3, 1b4fdefd, 37ac45f, 3df1a40, a85ce3b, c3edd7f, and f2499b7. Rebuild affected kernels and redeploy firmware images that include the corresponding stable release.

Workarounds

Blacklist the stm32-cec kernel module on systems that do not require HDMI-CEC functionality.
Physically disconnect untrusted HDMI peers from affected STM32 devices until patched firmware is deployed.
Segment CEC-capable devices onto isolated display infrastructure to reduce exposure to hostile peers.

bash

# Configuration example: disable the vulnerable driver until a patched kernel is deployed
echo "blacklist stm32-cec" | sudo tee /etc/modprobe.d/blacklist-stm32-cec.conf
sudo rmmod stm32-cec 2>/dev/null || true
sudo update-initramfs -u