CVE-2026-89894
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A vulnerability was found in the Linux kernel cx231xx media driver where format or standard changes (vidioc_s_fmt_vid_cap, vidioc_s_std) were rejected only when the video queue was busy, not the VBI queue. Since the VBI queue shares the same geometry (dev->width, dev->norm), an application could enlarge the width or switch to PAL while the VBI stream was running, causing a heap out-of-bounds write in cx231xx_do_vbi_copy().
Risk Assessment
A local attacker with access to a cx231xx device can trigger a heap out-of-bounds write, leading to kernel memory corruption, system crash, or potentially arbitrary code execution with kernel privileges.
Recommendation
Update the Linux kernel to a version containing the fix that rejects format and standard changes when the VBI queue is busy as well. Until patched, restrict access to cx231xx devices to trusted users only.
Related vulnerabilities
- CVE-2026-116508Critical
TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a stack-based buffer overflow in function sub_402340 of infostat.cgi (Device-Information CGI component). Manipulating the CONTENT_LENGTH argument causes overflow, and the exploit is publicly available.
- CVE-2026-116506Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the apmib_set function in firewall.so is vulnerable to command injection. The vulnerability can be exploited remotely, and a public exploit is available.
- CVE-2026-116505Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the getDeviceInfo function in /var/lib/misc/udhcpd.leases is vulnerable to command injection via manipulation of the MAC address argument. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-116504Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the setCloudUpgradeFW function in lib/cste_modules/upgrade.so is vulnerable to command injection via manipulation of the FileName argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-110720Critical
consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules. This may allow an attacker to obtain elevated Consul privileges.
- CVE-2026-10757Critical
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with service access privileges to issue database-specific functions that should not be allowed.
- CVE-2026-102649Critical
A vulnerability in the Burrito Kubernetes operator (Terraform Automation Collaboration Software) prior to 0.13.0 allows the POST /api/webhook endpoint to accept unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value. Anyone who can reach the burrito-server endpoint and knows a tracked repository's URL can forge events to create or delete TerraformPullRequest custom resources with attacker-chosen Branch, Base, and ID fields. For GitHub pull_request events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch, potentially causing an unauthorized terraform plan using the operator's stored git and cloud credentials.
- CVE-2026-115905Critical
Through 9.0.4, the Rust zip library's ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata. A crafted archive can appear benign to a component inspecting the central directory but cause a streaming extractor to write a different attacker-selected path and content.
- CVE-2026-112346Critical
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability. The DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default.
- CVE-2026-93328Critical
Path Traversal and Missing Authorization in the cloud-storage source of Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide dev->width / dev->norm but only refuse the change when the *video* queue (dev->vidq) is busy. The VBI queue (dev->vbiq) shares that same geometry: cx231xx_init_vbi_isoc() latches dma_q->lines_per_field from dev->norm, the VBI videobuf2 plane is sized from dev->width / dev->norm in vbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then recomputes the destination offset from the *live* dev->width and the latched lines_per_field on every URB completion: offset = lines_completed * (dev->width << 1) + ...; if (dma_q->current_field == 2) offset += dev->width * 2 * dma_q->lines_per_field; memcpy(plane + offset, p_buffer, lencopy); Because the VBI node shares video_ioctl_ops with the video node, an application can size a small VBI plane (REQBUFS/QBUF with a small width, or with the NTSC standard), then enlarge dev->width (or switch dev->norm to PAL) through the video node while the VBI stream is running -- the change is allowed because only dev->vidq is checked -- and let the device deliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the offset with the larger geometry and memcpy()s past the end of the smaller plane that was already allocated, a heap out-of-bounds write whose offset is attacker-chosen and whose contents come from the device. The per-field guard in cx231xx_copy_vbi_line() does not help: it bounds the copy against the latched lines_per_field, not the plane's real capacity, and vb2 does not re-run buf_prepare() for an already prepared buffer. Refuse the format/standard change when the VBI queue is busy as well, so the geometry cannot change underneath an allocated VBI buffer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS