CVE-2026-89866
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Resume device before setting EOS flag Setting the EOS flag talks to the firmware via send_firmware_command(), which accesses VPU registers. Both the STREAMOFF path (wave5_vpu_dec_job_abort()) and the V4L2_DEC_CMD_STOP path (wave5_vpu_dec_stop()) can run while the device is runtime suspended, so those register accesses hit powered-down hardware and the SoC raises an asynchronous SError, panicking the kernel: SError Interrupt on CPU3, code 0x00000000bf000000 -- SError send_firmware_command+0x2c/0x160 [wave5] wave5_vpu_dec_set_bitstream_flag+0x6c/0x80 [wave5] wave5_vpu_dec_update_bitstream_buffer+0x80/0xec [wave5] wave5_vpu_dec_job_abort+0x44/0xa0 [wave5] v4l2_m2m_cancel_job+0x110/0x19c [v4l2_mem2mem] v4l2_m2m_streamoff+0x24/0x140 [v4l2_mem2mem] Resume the device with pm_runtime_resume_and_get() around the EOS firmware command and release it with pm_runtime_put_autosuspend(), matching the runtime PM handling already done in wave5_vpu_dec_device_run().
Affected versions
Linux kernel versions
6.8
and later are affected. Fixed in
7.2.5,
7.3-rc1
and their respective stable series.
References
2 totalFrequently asked questions
-
What is CVE-2026-89866?
CVE-2026-89866 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.8 onward and has been patched in 7.2.5 and 7.3-rc1. CVE-2026-89866 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-89866?
Yes. CVE-2026-89866 has been patched. Fixed versions include 7.2.5 and 7.3-rc1. If you are running Linux kernel 6.8 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-89866 actively exploited?
No. CVE-2026-89866 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.