CVE-2026-89893

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: cx23885: cancel NetUP CI work before teardown

netup_ci_exit() frees a netup_ci_state while its work item,

netup_read_ci_status(), may still be pending or running on the system

workqueue. The worker obtains the state with container_of() and

dereferences it, so it must not outlive the state.

netup_ci_init() queues the initial status read, and CI GPIO interrupts

subsequently queue the same work from netup_ci_slot_status(). During

remove, cx23885_finidev() calls free_irq() before the CI device is

unregistered. free_irq() prevents further IRQ handlers from running,

but does not drain work queued previously, so the worker can run after

netup_ci_exit() frees the state.

Call cancel_work_sync() before dvb_ca_en50221_release() and kfree().

This issue was found by an in-house static analysis tool.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References