Out-of-bounds write in Linux kernel - CVE-2026-89894

Vulnerability identifier: #VU150387

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-89894

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a heap-based out-of-bounds write.

The vulnerability exists due to a heap-based buffer overflow in cx231xx VBI buffer handling in cx231xx_do_vbi_copy() when changing video geometry while a VBI stream is running. A local user can allocate a small VBI buffer and change the video width or standard to write past the allocated buffer.

Exploitation requires the device to deliver a field-2 VBI payload.

Linux kernel
Debian Linux
SUSE Linux Micro Extras
SUSE Linux Micro
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
openEuler
linux (Ubuntu package)
linux-kvm (Ubuntu package)
linux-gcp (Ubuntu package)
linux-aws (Ubuntu package)
linux-azure (Ubuntu package)
linux-oracle (Ubuntu package)
linux-lowlatency (Ubuntu package)
linux-gke (Ubuntu package)
linux-aws-5.15 (Ubuntu package)
linux-lowlatency-hwe-5.15 (Ubuntu package)
linux-hwe-5.15 (Ubuntu package)
linux-fips (Ubuntu package)
linux-azure-5.15 (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-intel-iotg (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-realtime (Ubuntu package)
linux-gkeop (Ubuntu package)
linux-ibm-5.15 (Ubuntu package)
linux-nvidia-tegra (Ubuntu package)
linux-azure-fde-5.15 (Ubuntu package)
linux-ibm (Ubuntu package)
linux-intel-iotg-5.15 (Ubuntu package)
linux-oracle-5.15 (Ubuntu package)
linux-gcp-5.15 (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-intel-iot-realtime (Ubuntu package)
linux-gcp-fips (Ubuntu package)
linux-aws-fips (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
bpftool
kernel
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-source
kernel-headers
kernel-devel
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
kernel-tools
kernel-default
kernel-64kb
kernel-64kb-debugsource
kernel-64kb-devel
kernel-default-devel
kernel-syms
kernel-obs-build
kernel-obs-build-debugsource
kernel-default-debugsource
kernel-default-devel-debuginfo
kernel (Red Hat package)
linux (Debian package)

Install security update from vendor's repository.

linux (Ubuntu package) - addressed in versions 5.15.0-202.212, 7.0.0-42.42
linux-kvm (Ubuntu package) - update to 5.15.0-1111.116
linux-gcp (Ubuntu package) - addressed in versions 5.15.0-1120.130, 7.0.0-1016.18
linux-aws (Ubuntu package) - addressed in versions 5.15.0-1119.126, 7.0.0-1016.17
linux-azure (Ubuntu package) - update to 5.15.0-1125.134
linux-oracle (Ubuntu package) - addressed in versions 5.15.0-1116.122, 7.0.0-1015.16
linux-lowlatency (Ubuntu package) - update to 5.15.0-197.207
linux-gke (Ubuntu package) - update to 5.15.0-1115.121
linux-aws-5.15 (Ubuntu package) - update to 5.15.0-1119.126~20.04.1
linux-lowlatency-hwe-5.15 (Ubuntu package) - update to 5.15.0-197.207~20.04.1
linux-hwe-5.15 (Ubuntu package) - update to 5.15.0-202.212~20.04.1
linux-fips (Ubuntu package) - update to 5.15.0-202.212+fips1
linux-azure-5.15 (Ubuntu package) - update to 5.15.0-1125.134~20.04.1
linux-nvidia (Ubuntu package) - update to 5.15.0-1114.115
linux-intel-iotg (Ubuntu package) - update to 5.15.0-1114.120
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-realtime (Ubuntu package) - update to 5.15.0-1118.127
linux-gkeop (Ubuntu package) - update to 5.15.0-1102.110
linux-ibm-5.15 (Ubuntu package) - update to 5.15.0-1113.117~20.04.1
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-azure-fde-5.15 (Ubuntu package) - update to 5.15.0-1124.133~20.04.1
linux-ibm (Ubuntu package) - addressed in versions 5.15.0-1113.117, 7.0.0-1017.17
linux-intel-iotg-5.15 (Ubuntu package) - update to 5.15.0-1114.120~20.04.1
linux-oracle-5.15 (Ubuntu package) - update to 5.15.0-1116.122~20.04.1
linux-gcp-5.15 (Ubuntu package) - update to 5.15.0-1120.130~20.04.1
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux-azure-fde (Ubuntu package) - update to 5.15.0-1124.133
linux-intel-iot-realtime (Ubuntu package) - update to 5.15.0-1111.115
linux-gcp-fips (Ubuntu package) - update to 5.15.0-1120.130+fips1
linux-aws-fips (Ubuntu package) - update to 5.15.0-1119.126+fips1
linux-azure-fips (Ubuntu package) - update to 5.15.0-1125.134+fips1
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17
bpftool - update to 5.10.0-335.0.0.236
kernel - update to 5.10.0-335.0.0.236
python3-perf-debuginfo - update to 5.10.0-335.0.0.236
python3-perf - update to 5.10.0-335.0.0.236
perf-debuginfo - update to 5.10.0-335.0.0.236
perf - update to 5.10.0-335.0.0.236
kernel-tools-devel - update to 5.10.0-335.0.0.236
kernel-tools-debuginfo - update to 5.10.0-335.0.0.236
kernel-source - update to 5.10.0-335.0.0.236
kernel-headers - update to 5.10.0-335.0.0.236
kernel-devel - update to 5.10.0-335.0.0.236
kernel-debugsource - update to 5.10.0-335.0.0.236
kernel-debuginfo - update to 5.10.0-335.0.0.236
bpftool-debuginfo - update to 5.10.0-335.0.0.236
kernel-tools - update to 5.10.0-335.0.0.236
kernel-default - update to 6.4.0-159998.55.1
kernel-64kb - update to 6.4.0-159998.55.1
kernel-64kb-debugsource - update to 6.4.0-159998.55.1
kernel-64kb-devel - update to 6.4.0-159998.55.1
kernel-default-devel - update to 6.4.0-159998.55.1
kernel-syms - update to 6.4.0-159998.55.1
kernel-obs-build - update to 6.4.0-159998.55.1
kernel-obs-build-debugsource - update to 6.4.0-159998.55.1
kernel-default-debugsource - update to 6.4.0-159998.55.1
kernel-default-devel-debuginfo - update to 6.4.0-159998.55.1
kernel (Red Hat package) - update to 6.12.0-211.66.1.el10_2
linux (Debian package) - update to 6.12.111-1

• https://git.kernel.org/stable/c/1d1079db8d1807e259a1d2679ed314949797aad9
• https://git.kernel.org/stable/c/54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d
• https://git.kernel.org/stable/c/627a121c15fe05a541f44d86016294b80bada75d
• https://git.kernel.org/stable/c/7087bef6510c7df5df0b19192633b8ecc0f33a6f
• https://git.kernel.org/stable/c/90d50648af36a1fbf5dbc99238de6fd0e58a13e0
• https://git.kernel.org/stable/c/a5dd3d7fba358ff9486f3f51b2a9038348c0970a
• https://git.kernel.org/stable/c/a636c72c7f522d984fa498fc0631f33a2d0be3fd
• https://git.kernel.org/stable/c/aa3314506deb9703bcf0e889db08959440228fbf

• Out-of-bounds write in Linux kernel usb cx231xx driver
• openEuler 22.03 LTS SP4 update for kernel
• Debian update for linux
• Red Hat Enterprise Linux 10 update for kernel
• Ubuntu update for linux-azure-fde
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more
• SUSE update for the Linux Kernel