OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-89897

HIGH · CVSS 7.5 EPSS 0.36%

Source: NVD + CISA KEV + EPSS · Published 2026-09-16 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

A vulnerability in the Linux kernel affects the Consumer Electronics Control (CEC) subsystem, where the `cec_receive_notify()` function improperly accesses the exclusive follower pointer without proper locking mechanisms. This oversight could lead to race conditions, potentially allowing unauthorized access or manipulation of CEC messages during mode changes. Linux system administrators and developers utilizing the CEC feature should prioritize applying patches to mitigate any risks associated with this vulnerability.

CVE
CVE-2026-89897
Severity
HIGH
CVSS
7.5
EPSS
0.36%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: media: cec: Serialize exclusive follower delivery cec_receive_notify() reads the exclusive follower pointer without the adapter lock. Serialize the no-follower check and message delivery against mode changes and release.