{"id":"CVE-2026-89894","revision":"f02e956a6c84491c98a6108b6a567a7f","records":[{"revision":"f02e956a6c84491c98a6108b6a567a7f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89894","aliases":[],"title":"media: cx231xx: reject geometry changes while the VBI queue is busy","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx231xx: reject geometry changes while the VBI queue is busy\n\nvidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide\ndev->width / dev->norm but only refuse the change when the *video* queue\n(dev->vidq) is busy. The VBI queue (dev->vbiq) shares that same geometry:\ncx231xx_init_vbi_isoc() latches dma_q->lines_per_field from dev->norm,\nthe VBI videobuf2 plane is sized from dev->width / dev->norm in\nvbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then\nrecomputes the destination offset from the *live* dev->width and the\nlatched lines_per_field on every URB completion:\n\n\toffset = lines_completed * (dev->width << 1) + ...;\n\tif (dma_q->current_field == 2)\n\t\toffset += dev->width * 2 * dma_q->lines_per_field;\n\tmemcpy(plane + offset, p_buffer, lencopy);\n\nBecause the VBI node shares video_ioctl_ops with the video node, an\napplication can size a small VBI plane (REQBUFS/QBUF with a small width,\nor with the NTSC standard), then enlarge dev->width (or switch dev->norm\nto PAL) through the video node while the VBI stream is running -- the\nchange is allowed because only dev->vidq is checked -- and let the device\ndeliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the\noffset with the larger geometry and memcpy()s past the end of the smaller\nplane that was already allocated, a heap out-of-bounds write whose offset\nis attacker-chosen and whose contents come from the device. The\nper-field guard in cx231xx_copy_vbi_line() does not help: it bounds the\ncopy against the latched lines_per_field, not the plane's real capacity,\nand vb2 does not re-run buf_prepare() for an already prepared buffer.\n\nRefuse the format/standard change when the VBI queue is busy as well, so\nthe geometry cannot change underneath an allocated VBI buffer.","state":0,"publishedAt":"2026-09-16T10:31:56.101+00:00","modifiedAt":"2026-10-19T08:54:27.208+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/media/usb/cx231xx/cx231xx-video.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\n                            \"lessThan\": \"aa3314506deb9703bcf0e889db08959440228fbf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\n                            \"lessThan\": \"90d50648af36a1fbf5dbc99238de6fd0e58a13e0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\n                            \"lessThan\": \"a5dd3d7fba358ff9486f3f51b2a9038348c0970a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\n                            \"lessThan\": \"54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\n                            \"lessThan\": \"1d1079db8d1807e259a1d2679ed314949797aad9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\n                            \"lessThan\": \"7087bef6510c7df5df0b19192633b8ecc0f33a6f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\n                            \"lessThan\": \"a636c72c7f522d984fa498fc0631f33a2d0be3fd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\n                            \"lessThan\": \"627a121c15fe05a541f44d86016294b80bada75d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/media/usb/cx231xx/cx231xx-video.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.5\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/aa3314506deb9703bcf0e889db08959440228fbf","https://git.kernel.org/stable/c/90d50648af36a1fbf5dbc99238de6fd0e58a13e0","https://git.kernel.org/stable/c/a5dd3d7fba358ff9486f3f51b2a9038348c0970a","https://git.kernel.org/stable/c/54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d","https://git.kernel.org/stable/c/1d1079db8d1807e259a1d2679ed314949797aad9","https://git.kernel.org/stable/c/7087bef6510c7df5df0b19192633b8ecc0f33a6f","https://git.kernel.org/stable/c/a636c72c7f522d984fa498fc0631f33a2d0be3fd","https://git.kernel.org/stable/c/627a121c15fe05a541f44d86016294b80bada75d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89894","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89894","identifiers":["CVE-2026-89894"]},"retained":false,"historicalAffected":[]}],"coverage":[]}