---
id: CVE-2026-89893
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: cx23885: cancel NetUP CI work before teardown

  netup_ci_exit() frees a netup_ci_state while its work item,
  netup_read_ci_status(), may still be pending or runnin…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: cx23885: cancel NetUP CI work before teardown

  netup_ci_exit() frees a netup_ci_state while its work item,
  netup_read_ci_status(), may still be pending or runnin…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c184dcd282337c09695a4c1761d7ac77fdc8fb7d <
    aaf76794b870b0f391eff339252a2e2e22f33a4a
  - >-
    Linux >= c184dcd282337c09695a4c1761d7ac77fdc8fb7d <
    f7ff5adb63c1b277565afa54ccc0924d841b4a52
  - >-
    Linux >= c184dcd282337c09695a4c1761d7ac77fdc8fb7d <
    140ecbcbf978fbe60f83f8d4f8b1199029a5c763
  - >-
    Linux >= c184dcd282337c09695a4c1761d7ac77fdc8fb7d <
    ec82b0cf7f75fd95802592dcc9560fc7f529bba4
  - >-
    Linux >= c184dcd282337c09695a4c1761d7ac77fdc8fb7d <
    5deec890ecfa04d21cfa9bb9a2fe5e9dc98db5c5
  - >-
    Linux >= c184dcd282337c09695a4c1761d7ac77fdc8fb7d <
    bf3f49273d5bf6acbdad18ff44c01ffcf7a7a146
  - >-
    Linux >= c184dcd282337c09695a4c1761d7ac77fdc8fb7d <
    99cd62b9b1c818d6d01a87be9a8e5796314150a2
  - >-
    Linux >= c184dcd282337c09695a4c1761d7ac77fdc8fb7d <
    4e143d662ca94888b494b2427fc9e34494eb933a
  - Linux 2.6.30
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:15.647'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89893'
references:
  - url: 'https://git.kernel.org/stable/c/140ecbcbf978fbe60f83f8d4f8b1199029a5c763'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4e143d662ca94888b494b2427fc9e34494eb933a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5deec890ecfa04d21cfa9bb9a2fe5e9dc98db5c5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/99cd62b9b1c818d6d01a87be9a8e5796314150a2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/aaf76794b870b0f391eff339252a2e2e22f33a4a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bf3f49273d5bf6acbdad18ff44c01ffcf7a7a146'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ec82b0cf7f75fd95802592dcc9560fc7f529bba4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f7ff5adb63c1b277565afa54ccc0924d841b4a52'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.981Z'
epss: 0.00176
epssPercentile: 0.06296
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: cx23885: cancel NetUP CI work before teardown

netup_ci_exit() frees a netup_ci_state while its work item,
netup_read_ci_status(), may still be pending or running on the system
workqueue. The worker obtains the state with container_of() and
dereferences it, so it must not outlive the state.

netup_ci_init() queues the initial status read, and CI GPIO interrupts
subsequently queue the same work from netup_ci_slot_status(). During
remove, cx23885_finidev() calls free_irq() before the CI device is
unregistered. free_irq() prevents further IRQ handlers from running,
but does not drain work queued previously, so the worker can run after
netup_ci_exit() frees the state.

Call cancel_work_sync() before dvb_ca_en50221_release() and kfree().

This issue was found by an in-house static analysis tool.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.