CVE-2026-89894

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: cx231xx: reject geometry changes while the VBI queue is busy

vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide

dev->width / dev->norm but only refuse the change when the *video* queue

(dev->vidq) is busy. The VBI queue (dev->vbiq) shares that same geometry:

cx231xx_init_vbi_isoc() latches dma_q->lines_per_field from dev->norm,

the VBI videobuf2 plane is sized from dev->width / dev->norm in

vbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then

recomputes the destination offset from the *live* dev->width and the

latched lines_per_field on every URB completion:

offset = lines_completed * (dev->width << 1) + ...;

if (dma_q->current_field == 2)

offset += dev->width * 2 * dma_q->lines_per_field;

memcpy(plane + offset, p_buffer, lencopy);

Because the VBI node shares video_ioctl_ops with the video node, an

application can size a small VBI plane (REQBUFS/QBUF with a small width,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References