CVE-2026-89894: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89894 Overview

CVE-2026-89894 is a heap out-of-bounds write vulnerability in the Linux kernel's cx231xx media driver. The flaw exists because vidioc_s_fmt_vid_cap() and vidioc_s_std() only reject geometry changes when the video queue (dev->vidq) is busy. The Vertical Blanking Interval (VBI) queue (dev->vbiq) shares the same dev->width and dev->norm geometry but is not checked. A local user with access to the video device node can resize a VBI buffer, enlarge the geometry through the video node, then trigger cx231xx_do_vbi_copy() to write past the allocated plane using an attacker-influenced offset.

Critical Impact
A local user with access to the cx231xx V4L2 device can trigger a heap out-of-bounds write with an attacker-chosen offset, enabling privilege escalation or kernel memory corruption.

Affected Products

Linux kernel — cx231xx USB media driver (drivers/media/usb/cx231xx)
Multiple stable branches referenced by fix commits 1d1079db, 54ac6df8, 627a121c, 7087bef6, 90d50648, a5dd3d7f, a636c72c, aa331450
Systems exposing Conexant cx231xx-based USB video capture hardware to unprivileged users

Discovery Timeline

2026-09-16 - CVE-2026-89894 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89894

Vulnerability Analysis

The cx231xx driver exposes both a video capture node and a VBI capture node that share the same video_ioctl_ops. The device-wide fields dev->width and dev->norm govern buffer geometry for both queues. When user space calls VIDIOC_S_FMT or VIDIOC_S_STD, the driver checks whether dev->vidq is busy but does not check dev->vbiq.

An attacker allocates a small VBI plane by issuing VIDIOC_REQBUFS and VIDIOC_QBUF under NTSC or a narrow width. The VBI stream begins, latching dma_q->lines_per_field from dev->norm. The attacker then enlarges dev->width or switches dev->norm to PAL through the video node. Because only dev->vidq is inspected, the change is accepted.

When a field-2 URB completes, cx231xx_do_vbi_copy() recomputes the destination offset using the live dev->width and latched lines_per_field:

offset = lines_completed * (dev->width << 1) + ... and, for field 2, offset += dev->width * 2 * dma_q->lines_per_field. The subsequent memcpy(plane + offset, p_buffer, lencopy) writes past the smaller plane. The per-field guard in cx231xx_copy_vbi_line() bounds copies against the latched lines_per_field, not the plane's real capacity.

Root Cause

The root cause is incomplete input validation. Geometry changes are gated on video queue state only, while the VBI queue shares the same geometry. videobuf2 does not re-run buf_prepare() for buffers that were already prepared, so the plane size becomes stale relative to the driver's current geometry.

Attack Vector

Exploitation requires local access and read/write permission on /dev/video* and /dev/vbi* nodes exposed by a cx231xx-based USB capture device. No user interaction is required. The write offset is influenced by the attacker-controlled width and standard, and the written contents originate from the device stream.

See the upstream patches referenced in the Linux Kernel Commit 1d1079db and Linux Kernel Commit 54ac6df8 for the corrective logic.

Detection Methods for CVE-2026-89894

Indicators of Compromise

Kernel messages referencing cx231xx VBI copy operations or SLUB/KASAN out-of-bounds write reports involving cx231xx_do_vbi_copy.
Unexpected process access patterns to /dev/video* and /dev/vbi* nodes from non-media applications.
Kernel panics or oops traces originating from drivers/media/usb/cx231xx on affected hosts.

Detection Strategies

Enable KASAN on test kernels to surface heap out-of-bounds writes in the cx231xx VBI path.
Audit which local users and groups (typically video) hold access to V4L2 device nodes on systems with Conexant capture hardware.
Correlate VIDIOC_S_FMT and VIDIOC_S_STD ioctl calls against active VBI streams via auditd rules on device nodes.

Monitoring Recommendations

Forward dmesg and audit logs to a centralized analytics platform and alert on kernel crashes referencing the cx231xx module.
Monitor loaded kernel modules and flag unexpected loads of cx231xx on servers that should not host capture hardware.
Track patch level of the Linux kernel across the fleet and alert on hosts running unpatched stable branches.

How to Mitigate CVE-2026-89894

Immediate Actions Required

Apply the upstream fix that also refuses format and standard changes when dev->vbiq is busy, mirroring the existing dev->vidq check.
Restrict access to /dev/video* and /dev/vbi* nodes to trusted users, and remove membership of the video group from untrusted accounts.
Unload the cx231xx module (modprobe -r cx231xx) on systems without a legitimate need for Conexant USB capture support.

Patch Information

The vulnerability is resolved by refusing geometry changes while the VBI queue is busy. Fix commits are available at Linux Kernel Commit 627a121c, Linux Kernel Commit 7087bef6, Linux Kernel Commit 90d50648, Linux Kernel Commit a5dd3d7f, Linux Kernel Commit a636c72c, and Linux Kernel Commit aa331450. Update to a distribution kernel that incorporates these commits.

Workarounds

Blacklist the cx231xx module where the hardware is not required by adding blacklist cx231xx to /etc/modprobe.d/.
Use udev rules or filesystem ACLs to restrict /dev/video* and /dev/vbi* to a minimal set of trusted service accounts.
Physically disconnect Conexant cx231xx USB capture devices from multi-user hosts until patches are deployed.

bash

# Configuration example
# Blacklist the vulnerable driver until kernel is patched
echo 'blacklist cx231xx' | sudo tee /etc/modprobe.d/cx231xx-cve-2026-89894.conf
sudo modprobe -r cx231xx 2>/dev/null || true
sudo update-initramfs -u

# Restrict access to V4L2 device nodes
sudo chmod 0660 /dev/video* /dev/vbi* 2>/dev/null
sudo gpasswd -d untrusted_user video