CVE-2026-89875

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: ti: vpe: quiesce overflow recovery before freeing streams

The VIP overflow recovery worker is armed from the hardirq handler when a

FIFO overflow is detected, and the list-complete path looks the stream up

through the VPDMA list private pointer. Both keep touching stream, port

and device state; the recovery worker also resets the parser and VPDMA,

repopulates the descriptor list, and re-enables the per-list IRQs.

vip_stop_streaming() masks and clears the per-list IRQs, but it neither

synchronizes the hardirq handler nor disables recovery_work. An overflow

IRQ that has already queued recovery_work, or a list-complete IRQ in

flight when the stream is torn down, can therefore still dereference the

stream after its resources are released: the descriptor list is freed by

vip_release_stream() on file release, and the stream itself by

free_stream() on unbind/remove.

Drain the recovery worker and the IRQ handler at

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References