{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  media: cx231xx: reject geometry changes while the VBI queue is busy  vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide dev-\u003ewidth / dev-\u003enorm but only refuse the change when the *video* queue (dev-\u003evidq) is busy. The VBI queue (dev-\u003evbiq) shares that same geometry: cx231xx_init_vbi_isoc() latches dma_q-\u003elines_per_field from dev-\u003enorm, the VBI videobuf2 plane is sized from dev-\u003ewidth / dev-\u003enorm in vbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then recomputes the destination offset from the *live* dev-\u003ewidth and the latched lines_per_field on every URB completion:  \toffset = lines_completed * (dev-\u003ewidth \u003c\u003c 1) + ...; \tif (dma_q-\u003ecurrent_field == 2) \t\toffset += dev-\u003ewidth * 2 * dma_q-\u003elines_per_field; \tmemcpy(plane + offset, p_buffer, lencopy);  Because the VBI node shares video_ioctl_ops with the video node, an application can size a small VBI plane (REQBUFS/QBUF with a small width, or with the NTSC standard), then enlarge dev-\u003ewidth (or switch dev-\u003enorm to PAL) through the video node while the VBI stream is running -- the change is allowed because only dev-\u003evidq is checked -- and let the device deliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the offset with the larger geometry and memcpy()s past the end of the smaller plane that was already allocated, a heap out-of-bounds write whose offset is attacker-chosen and whose contents come from the device. The per-field guard in cx231xx_copy_vbi_line() does not help: it bounds the copy against the latched lines_per_field, not the plane's real capacity, and vb2 does not re-run buf_prepare() for an already prepared buffer.  Refuse the format/standard change when the VBI queue is busy as well, so the geometry cannot change underneath an allocated VBI buffer.",
  "id": "DEBIAN-CVE-2026-89894",
  "modified": "2026-09-17T04:47:30.586850090Z",
  "published": "2026-09-16T11:16:58.127Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89894"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-89894"
  ]
}