CVE-2026-89875: Linux Kernel VPE Driver Privilege Escalation

CVE-2026-89875 Overview

CVE-2026-89875 is a Use-After-Free vulnerability in the Linux kernel's Texas Instruments Video Input Port (VIP) driver under drivers/media/platform/ti/vpe. The flaw exists in the overflow recovery path, where the recovery worker and list-complete interrupt handler can dereference stream, port, and device state after those resources have been released. The vip_stop_streaming() routine masks per-list IRQs but does not synchronize the hardirq handler or disable the recovery_work worker. A racing overflow IRQ can therefore access freed descriptor lists or stream structures during teardown.

Critical Impact
A local attacker with the ability to interact with the VIP media device can trigger a race between FIFO overflow recovery and stream teardown, leading to use-after-free conditions with high impact on confidentiality, integrity, and availability.

Affected Products

Linux kernel branches containing the TI VPE/VIP media driver (drivers/media/platform/ti/vpe)
Systems using Texas Instruments VIP hardware for video capture
Stable kernel trees prior to the fixes referenced in commits aeaacc30 and fd5b4a14

Discovery Timeline

2026-09-16 - CVE-2026-89875 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89875

Vulnerability Analysis

The VIP driver arms an overflow recovery worker from its hardirq handler when a FIFO overflow condition is detected. The list-complete code path resolves the active stream through the VPDMA list private pointer. Both paths continue to touch stream, port, and device state during their execution.

The recovery worker performs substantial work: it resets the parser and VPDMA engine, repopulates the descriptor list, and re-enables the per-list IRQs. When a userspace process stops streaming, vip_stop_streaming() masks and clears the per-list IRQs but performs no synchronization with the hardirq handler or the pending recovery worker.

An overflow IRQ that has already queued recovery_work, or a list-complete IRQ that is still in flight during teardown, can dereference the stream after vip_release_stream() frees the descriptor list on file release or after free_stream() releases the stream on unbind or device removal.

Root Cause

The root cause is missing lifecycle synchronization between asynchronous kernel workers, interrupt handlers, and stream teardown paths in the VIP driver. The teardown code assumed masking per-list IRQs was sufficient to quiesce all consumers of stream state. In practice, recovery_work scheduled from a prior IRQ can outlive the mask operation, and the worker itself can re-enable the parser and IRQ sources after teardown believed them stopped.

Attack Vector

Exploitation requires local access with permission to open the VIP media device node. An attacker induces FIFO overflow conditions to schedule recovery_work, then races stream teardown by closing the device or triggering an unbind. If the recovery worker or a list-complete IRQ handler executes after vip_release_stream() or free_stream(), it dereferences freed memory. This can produce kernel memory corruption or information disclosure suitable for local privilege escalation.

The upstream fix introduces a shared vip_quiesce_stream() helper invoked at both teardown points. It uses disable_work_sync() to cancel and drain recovery_work while raising its disable depth so racing IRQ handlers cannot requeue it. It then calls disable_irqs() followed by synchronize_irq() to wait for in-flight handlers. The recovery_work item is created disabled and enabled in vip_start_streaming() before IRQs, pairing worker enablement with teardown disablement across the streaming lifecycle. See the patch details in kernel commit aeaacc30 and kernel commit fd5b4a14.

// No verified proof-of-concept code is available for this issue.
// Refer to the upstream commits for the fix implementation.

Detection Methods for CVE-2026-89875

Indicators of Compromise

Unexpected kernel oops or panic messages referencing vip_, vpdma_, or recovery_work symbols in dmesg or /var/log/kern.log
KASAN use-after-free reports involving VIP stream or descriptor list allocations on kernels built with address sanitizer
Repeated VIP FIFO overflow warnings immediately followed by device close, unbind, or driver removal events

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test systems using the TI VIP driver to catch use-after-free access during stream teardown
Audit kernel version strings across fleets to identify hosts running vulnerable branches of drivers/media/platform/ti/vpe
Correlate v4l2 device open, VIDIOC_STREAMOFF, and driver unbind syscalls with subsequent kernel error messages

Monitoring Recommendations

Ship kernel ring buffer contents and audit logs to a centralized data lake for anomaly analysis and retention
Alert on kernel crash events on embedded and industrial systems that ship TI SoCs with VIP peripherals
Track modprobe, rmmod, and driver bind or unbind operations on media subsystem modules for unexpected activity

How to Mitigate CVE-2026-89875

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits aeaacc30 and fd5b4a14 to affected kernel trees and rebuild
Restrict access to /dev/video* nodes exposed by the TI VIP driver to trusted users and groups via udev rules and filesystem permissions
Inventory embedded systems and industrial devices that use TI VPE hardware to prioritize kernel updates

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Review the exact changes in kernel commit aeaacc3001449d44b4ab7da56331121d1f3b137b and kernel commit fd5b4a14c87b21e1c9eaee603b01bb7fa7db45c8. Distribution kernel maintainers should backport both commits to any supported branch that still ships the VIP driver.

Workarounds

Unload the VIP driver module if the hardware is not in use, removing the vulnerable code path from the running kernel
Blacklist the VIP media module on systems that do not require TI video capture functionality
Constrain the set of user accounts permitted to open VIP video device nodes until patched kernels are deployed

bash

# Deny non-privileged access to VIP video device nodes
sudo chown root:video /dev/video0
sudo chmod 0660 /dev/video0

# Prevent the VIP driver from loading on hosts that do not need it
echo 'blacklist ti_vip' | sudo tee /etc/modprobe.d/blacklist-ti-vip.conf
sudo update-initramfs -u