CVE-2026-89869 Overview
CVE-2026-89869 is a race condition in the Linux kernel's Qualcomm Iris video processing unit (VPU) media driver. The flaw exists in the iris_vpu_power_off() function, which used disable_irq_nosync() to disable a threaded interrupt request (IRQ) handler during power-off. Because disable_irq_nosync() does not wait for an already queued threaded IRQ handler to complete, the handler could continue running after the VPU was powered down. The handler then attempts to access hardware registers on a powered-off device, which can lead to undefined behavior on affected Qualcomm platforms using the Iris media driver.
Critical Impact
A threaded IRQ handler may access VPU hardware registers after the device has been powered off, causing potential system instability on Qualcomm platforms.
Affected Products
- Linux kernel versions containing the Qualcomm Iris media driver (drivers/media/platform/qcom/iris)
- Devices using the Qualcomm Iris VPU for hardware video encode/decode
- Distributions shipping kernels prior to the patched commits b9c2215, d7f34cb, and ff98cd2
Discovery Timeline
- 2026-09-16 - CVE-2026-89869 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89869
Vulnerability Analysis
The Qualcomm Iris media driver registers its interrupt handler as a threaded IRQ. Threaded IRQ handlers run in a dedicated kernel thread rather than in hard interrupt context, allowing them to sleep and perform longer processing. The iris_vpu_power_off() path is responsible for quiescing the device before removing power.
The original implementation called disable_irq_nosync() to mask the interrupt line. This function returns immediately without waiting for any handler that is already executing or queued in the associated IRQ thread. As a result, the power-off sequence could proceed and cut power to the VPU while the threaded handler was still active. Subsequent register accesses from that handler target hardware that is no longer powered, producing unpredictable results on Qualcomm system-on-chip devices.
Root Cause
The root cause is incorrect synchronization between the power-management path and the threaded IRQ handler. disable_irq_nosync() only masks the interrupt without draining in-flight work, which is unsafe when a threaded handler may still touch device state. The correct primitive, disable_irq(), waits for any pending handler to finish before returning.
Attack Vector
This is a locally triggered kernel race condition rather than a remotely exploitable flaw. It is reached through normal power-management transitions of the Iris VPU, which are driven by media workloads and runtime power management. No authentication or user interaction beyond exercising video pipelines is required to hit the race. Consequences are limited to kernel-side stability on affected Qualcomm hardware; there is no evidence of memory corruption suitable for privilege escalation in the published fix description.
The upstream fix replaces disable_irq_nosync() with disable_irq() in iris_vpu_power_off(), ensuring the power-off path blocks until any in-flight threaded handler completes. Refer to the upstream commits b9c2215, d7f34cb, and ff98cd2 for the exact source change.
Detection Methods for CVE-2026-89869
Indicators of Compromise
- Kernel log messages referencing the iris driver during suspend, resume, or runtime power transitions
- Unexpected VPU register read/write warnings appearing shortly after power-off events
- Sporadic media pipeline failures, hangs, or system crashes on Qualcomm devices under video workloads
Detection Strategies
- Audit the running kernel version and compare against the fixed commits in stable branches
- Enable kernel lockdep and IRQ tracing on test devices to observe handler execution after iris_vpu_power_off()
- Review distribution changelogs for backports referencing the Iris media driver and threaded IRQ handling
Monitoring Recommendations
- Collect dmesg and journal logs from affected Qualcomm hardware and alert on iris driver warnings or oops entries
- Track kernel package versions across fleets to identify hosts still running vulnerable builds
- Monitor device stability metrics such as unexpected reboots or media subsystem resets on Qualcomm platforms
How to Mitigate CVE-2026-89869
Immediate Actions Required
- Update to a Linux kernel that includes commits b9c2215, d7f34cb, or ff98cd2 from the stable tree
- Apply vendor-supplied kernel updates for distributions shipping the Qualcomm Iris media driver
- Inventory devices using Qualcomm Iris VPU hardware to prioritize patching
Patch Information
The fix replaces disable_irq_nosync() with disable_irq() in iris_vpu_power_off() so the power-off path waits for any in-flight threaded IRQ handler to complete before returning. Patched commits are available in the Linux stable tree: b9c2215, d7f34cb, and ff98cd2. Rebuild and deploy kernels containing these commits, then reboot affected systems.
Workarounds
- Disable the Qualcomm Iris media driver on systems where hardware video acceleration is not required
- Avoid triggering runtime power management on the VPU by keeping the device active during media workloads where feasible
- Restrict access to media APIs that exercise the Iris power-off path until patched kernels are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.